Choosing Your Security Level
June 7, 2026
Not every agent needs Level 5 security. The right level depends on what your agent can access.
The Decision Table
| If your agent has access to... | Start at... | Why |
|---|---|---|
| Nothing important (demos, tutorials) | L1 | Blast radius is zero |
| Your source code and configs | L3 | A bad git push costs a day |
| Production credentials (AWS, DB) | L4-L5 | There is no acceptable failure |
| Customer data (PII, financial) | L5 | Compliance requires it |
Level 1-2: When You Can Get Away With It
L1 (system prompt rules) and L2 (safe-mode skill) work well for tutorial agents that only touch demo data, personal assistants with no production access, and agents running in isolated environments.
The model will refuse most dangerous requests. "Most" is the problem. At a 1% per-turn failure rate, over 100 turns there is a 63% chance of at least one failure.
Level 3: The Minimum for Production Code
L3 (blacklist hook) catches direct attacks like rm -rf /. But it misses the marquee break: the agent writes a Python script that does the damage, and the blacklist only sees "python cleanup.py" which is not in the blocklist.
Level 4: The Sweet Spot
Whitelist hooks only allow N safelisted commands. The agent cannot run python cleanup.py because python is not safelisted. This prevents the L3 marque break. Use L4 as your default for any agent with access to production systems.
Level 5: The Gold Standard
No bash at all. The agent has only purpose-built tools: Read, Write, Edit, Grep, Glob. Required for any agent handling customer data, financial transactions, or healthcare information.
Rule of Thumb
If the agent can touch anything you cannot easily roll back, start at L4 and plan to get to L5.
From Module 3 of the Agentic Engineering Course. The full module includes runnable code for all 6 security levels.