# Choosing Your Security Level

**June 7, 2026**

Not every agent needs Level 5 security. The right level depends on what your agent can access.

## The Decision Table

| If your agent has access to... | Start at... | Why |
|-------------------------------|-------------|-----|
| Nothing important (demos, tutorials) | L1 | Blast radius is zero |
| Your source code and configs | L3 | A bad git push costs a day |
| Production credentials (AWS, DB) | L4-L5 | There is no acceptable failure |
| Customer data (PII, financial) | L5 | Compliance requires it |

## Level 1-2: When You Can Get Away With It

L1 (system prompt rules) and L2 (safe-mode skill) work well for tutorial agents that only touch demo data, personal assistants with no production access, and agents running in isolated environments.

The model will refuse most dangerous requests. "Most" is the problem. At a 1% per-turn failure rate, over 100 turns there is a 63% chance of at least one failure.

## Level 3: The Minimum for Production Code

L3 (blacklist hook) catches direct attacks like `rm -rf /`. But it misses the marquee break: the agent writes a Python script that does the damage, and the blacklist only sees "python cleanup.py" which is not in the blocklist.

## Level 4: The Sweet Spot

Whitelist hooks only allow N safelisted commands. The agent cannot run `python cleanup.py` because `python` is not safelisted. This prevents the L3 marque break. Use L4 as your default for any agent with access to production systems.

## Level 5: The Gold Standard

No bash at all. The agent has only purpose-built tools: Read, Write, Edit, Grep, Glob. Required for any agent handling customer data, financial transactions, or healthcare information.

## Rule of Thumb

If the agent can touch anything you cannot easily roll back, start at L4 and plan to get to L5.

---

*From Module 3 of the [Agentic Engineering Course](/). The full module includes runnable code for all 6 security levels.*
