docs(tac): add insider-threat agent guidance

Capture the Security Fest talk in TAC loop-engineering guidance. Treat agents with file, tool, code, or deploy access as insider-threat candidates and require least privilege, no raw secrets, sandboxing, supply-chain checks, human approval for business-impacting actions, receipts, and promotion attestation.

pipeline/test_loop_engineering_meta_prompt.py

@@ -36,6 +36,12 @@ def test_loop_engineering_meta_prompt_locks_safety_fields():
         "Sweeper",
         "Architect/Primitive keeper",
         "role collapse means expertise is obsolete",
+        "Insider-threat model",
+        "least-privilege access",
+        "no raw secrets",
+        "human approval before any action with business",
+        "attestation that a human reviewed output",
+        "YouTube `yvJYw2gR0cU`",
         "External research anchors",
         "NVIDIA Secure Agent Workspace",
         "Infisical Agent Vault",

plans/meta-prompts/loop_engineering.md

@@ -114,6 +114,22 @@ Treat AI-era role archetypes as activity modes in the delivery loop, not permane
 
 Do not claim role collapse means expertise is obsolete. The safer claim is that boundaries flex while specialties, ownership, and best practices remain necessary.
 
+## Insider-threat model note
+
+Treat coding agents and frontier-model work agents as potential insider threats once they can read files, call tools, write code, or touch deploy paths. Plans that give an agent business-impacting access must include:
+
+- least-privilege access by default, with explicit allowlists for files, tools, APIs, and network;
+- no raw secrets in prompts, logs, workspaces, or agent-visible config;
+- sandboxed execution for generated code and dependency operations;
+- supply-chain checks before running generated install/build/test commands;
+- human approval before any action with business, security, financial, customer, or production risk;
+- append-only logs/receipts for agent decisions, tool calls, approvals, and promoted outputs;
+- attestation that a human reviewed output before promotion to production.
+
+Do not trust an agent because it is helpful, local, or model-authored. Trust only the bounded action, its receipt, and the verifier evidence.
+
+Reference: Security Fest 2026, Dan Tentler, "Claude is your insider threat now" (YouTube `yvJYw2gR0cU`).
+
 ## External research anchors
 
 Ground agent plans against external production guidance, not just video notes: