Skip to content

# Choosing Your Security Level ​

June 7, 2026

Not every agent needs Level 5 security. The right level depends on what your agent can access.

## The Decision Table ​

If your agent has access to... | Start at... | Why
--- | --- | ---
Nothing important (demos, tutorials) | L1 | Blast radius is zero
Your source code and configs | L3 | A bad git push costs a day
Production credentials (AWS, DB) | L4-L5 | There is no acceptable failure
Customer data (PII, financial) | L5 | Compliance requires it

## Level 1-2: When You Can Get Away With It ​

L1 (system prompt rules) and L2 (safe-mode skill) work well for tutorial agents that only touch demo data, personal assistants with no production access, and agents running in isolated environments.

The model will refuse most dangerous requests. "Most" is the problem. At a 1% per-turn failure rate, over 100 turns there is a 63% chance of at least one failure.

## Level 3: The Minimum for Production Code ​

L3 (blacklist hook) catches direct attacks like `rm -rf /`. But it misses the marquee break: the agent writes a Python script that does the damage, and the blacklist only sees "python cleanup.py" which is not in the blocklist.

## Level 4: The Sweet Spot ​

Whitelist hooks only allow N safelisted commands. The agent cannot run `python cleanup.py` because `python` is not safelisted. This prevents the L3 marque break. Use L4 as your default for any agent with access to production systems.

## Level 5: The Gold Standard ​

No bash at all. The agent has only purpose-built tools: Read, Write, Edit, Grep, Glob. Required for any agent handling customer data, financial transactions, or healthcare information.

## Rule of Thumb ​

If the agent can touch anything you cannot easily roll back, start at L4 and plan to get to L5.

From Module 3 of the Agentic Engineering Course. The full module includes runnable code for all 6 security levels.