June 7, 2026
Not every agent needs Level 5 security. The right level depends on what your agent can access.
| If your agent has access to... | Start at... | Why |
|---|---|---|
| Nothing important (demos, tutorials) | L1 | Blast radius is zero |
| Your source code and configs | L3 | A bad git push costs a day |
| Production credentials (AWS, DB) | L4-L5 | There is no acceptable failure |
| Customer data (PII, financial) | L5 | Compliance requires it |
L1 (system prompt rules) and L2 (safe-mode skill) work well for tutorial agents that only touch demo data, personal assistants with no production access, and agents running in isolated environments.
The model will refuse most dangerous requests. "Most" is the problem. At a 1% per-turn failure rate, over 100 turns there is a 63% chance of at least one failure.
L3 (blacklist hook) catches direct attacks like rm -rf /. But it misses the marquee break: the agent writes a Python script that does the damage, and the blacklist only sees "python cleanup.py" which is not in the blocklist.
Whitelist hooks only allow N safelisted commands. The agent cannot run python cleanup.py because python is not safelisted. This prevents the L3 marque break. Use L4 as your default for any agent with access to production systems.
No bash at all. The agent has only purpose-built tools: Read, Write, Edit, Grep, Glob. Required for any agent handling customer data, financial transactions, or healthcare information.
If the agent can touch anything you cannot easily roll back, start at L4 and plan to get to L5.
From Module 3 of the Agentic Engineering Course. The full module includes runnable code for all 6 security levels.
',18)])])}const m=t(n,[["render",l]]);export{p as __pageData,m as default};