artale
/
agentic-ai-engineering
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

docs(tac): add external agent safety anchors 

Ground TAC loop-engineering guidance in external production references: NVIDIA Secure Agent Workspace, Infisical Agent Vault, Anthropic agent evals, and OWASP AI Agent Security. Lock signed-action-only deploy posture and research markers with pytest.
This commit is contained in:
artale 2026-06-29 12:33:22 +02:00
parent e1f97ba1cd
commit 4f7ae7ffe1
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
pipeline/test_loop_engineering_meta_prompt.py
View File

@ -23,6 +23,12 @@ def test_loop_engineering_meta_prompt_locks_safety_fields():
"Team manages agents", "Team manages agents",
"vault/proxy credential injection", "vault/proxy credential injection",
"YouTube `hLUGXO5DSpo`", "YouTube `hLUGXO5DSpo`",
"External research anchors",
"NVIDIA Secure Agent Workspace",
"Infisical Agent Vault",
"Anthropic agent evals",
"OWASP AI Agent Security Cheat Sheet",
"signed-action-only",
"Model Workspace Protocol", "Model Workspace Protocol",
"00-intake/", "00-intake/",
"40-ship/", "40-ship/",

13
plans/meta-prompts/loop_engineering.md
View File

@ -85,6 +85,19 @@ Every autonomous work-agent plan must include:
Reference: Latent Space, "The Blueprint for Autonomous Work Agents" with Gavriel Cohen / NanoClaw (YouTube `hLUGXO5DSpo`). Reference: Latent Space, "The Blueprint for Autonomous Work Agents" with Gavriel Cohen / NanoClaw (YouTube `hLUGXO5DSpo`).
## External research anchors
Ground agent plans against external production guidance, not just video notes:
- NVIDIA Secure Agent Workspace: always-on agents need a managed workspace with credential proxy, enterprise tool access, governance, and runtime controls.
- Infisical Agent Vault: secrets stay in the vault and requests receive credentials through a proxy; agents must not hold raw secrets.
- Anthropic agent evals: judge trajectories and environment outcomes, not just final answers.
- OWASP AI Agent Security Cheat Sheet: treat prompt injection, memory poisoning, tool abuse, sandboxing, and access control as first-class risks.
These anchors support TAC's local rule: deploy remains signed-action-only through `git-proxy:8099/deploy`; do not reintroduce raw command deploy paths.
References: NVIDIA Secure Agent Workspace (`docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design`), Infisical Agent Vault (`infisical.com/blog/agent-vault-the-open-source-credential-proxy-and-vault-for-agents`), Anthropic "Demystifying evals for AI agents" (`anthropic.com/engineering/demystifying-evals-for-ai-agents`), OWASP AI Agent Security Cheat Sheet (`cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html`).
## Model Workspace Protocol note ## Model Workspace Protocol note
For sequential workflows with human review between stages, prefer folder-structured orchestration before multi-agent framework code. The Model Workspace Protocol pattern treats numbered folders as stages, markdown files as role/context carriers, and local scripts as the boring mechanical layer. For sequential workflows with human review between stages, prefer folder-structured orchestration before multi-agent framework code. The Model Workspace Protocol pattern treats numbered folders as stages, markdown files as role/context carriers, and local scripts as the boring mechanical layer.