From 9d7c2981d5f46d58a651f31d2320c42bbcec951f Mon Sep 17 00:00:00 2001 From: artale Date: Tue, 30 Jun 2026 14:52:55 +0200 Subject: [PATCH] docs(tac): add insider-threat agent guidance Capture the Security Fest talk in TAC loop-engineering guidance. Treat agents with file, tool, code, or deploy access as insider-threat candidates and require least privilege, no raw secrets, sandboxing, supply-chain checks, human approval for business-impacting actions, receipts, and promotion attestation. --- pipeline/test_loop_engineering_meta_prompt.py | 6 ++++++ plans/meta-prompts/loop_engineering.md | 16 ++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/pipeline/test_loop_engineering_meta_prompt.py b/pipeline/test_loop_engineering_meta_prompt.py index c4a7172..bb300df 100644 --- a/pipeline/test_loop_engineering_meta_prompt.py +++ b/pipeline/test_loop_engineering_meta_prompt.py @@ -36,6 +36,12 @@ def test_loop_engineering_meta_prompt_locks_safety_fields(): "Sweeper", "Architect/Primitive keeper", "role collapse means expertise is obsolete", + "Insider-threat model", + "least-privilege access", + "no raw secrets", + "human approval before any action with business", + "attestation that a human reviewed output", + "YouTube `yvJYw2gR0cU`", "External research anchors", "NVIDIA Secure Agent Workspace", "Infisical Agent Vault", diff --git a/plans/meta-prompts/loop_engineering.md b/plans/meta-prompts/loop_engineering.md index b6e2749..c2d675f 100644 --- a/plans/meta-prompts/loop_engineering.md +++ b/plans/meta-prompts/loop_engineering.md @@ -114,6 +114,22 @@ Treat AI-era role archetypes as activity modes in the delivery loop, not permane Do not claim role collapse means expertise is obsolete. The safer claim is that boundaries flex while specialties, ownership, and best practices remain necessary. +## Insider-threat model note + +Treat coding agents and frontier-model work agents as potential insider threats once they can read files, call tools, write code, or touch deploy paths. Plans that give an agent business-impacting access must include: + +- least-privilege access by default, with explicit allowlists for files, tools, APIs, and network; +- no raw secrets in prompts, logs, workspaces, or agent-visible config; +- sandboxed execution for generated code and dependency operations; +- supply-chain checks before running generated install/build/test commands; +- human approval before any action with business, security, financial, customer, or production risk; +- append-only logs/receipts for agent decisions, tool calls, approvals, and promoted outputs; +- attestation that a human reviewed output before promotion to production. + +Do not trust an agent because it is helpful, local, or model-authored. Trust only the bounded action, its receipt, and the verifier evidence. + +Reference: Security Fest 2026, Dan Tentler, "Claude is your insider threat now" (YouTube `yvJYw2gR0cU`). + ## External research anchors Ground agent plans against external production guidance, not just video notes: