Notes / AI Safety
Topic
Permissions, audit trails, and explainability, so teams can trust AI output and trace problems when they happen.
32
notes
In this topic
An Agent console is a scheduling and observation layer above coding Agents, with no model of its own. Before adopting one, a company checks four things - which Agents it supports, where session and audit records live, how the server is deployed and which remote channels are open, and whether to use stable or nightly. This note walks through each check using T3 Code.
When a company upgrades an agent's model or investigates a change in production behavior, it first checks the model, prompt, and tool definition versions recorded in the run logs. It then runs regression tests on a locked test set and compares tool call structure. The business process owner and the quality or risk team sign off together on a staged rollout.
For agent egress control, the sandbox denies all outbound traffic by default, and a domain allowlist and permitted request methods are configured per task. Separating the dependency install phase from task execution, limiting write methods on broad domains, and blocking private network ranges separately keep agents running while preventing data leaks.
When a company uses an onboarding agent to create email, office software, and business system accounts for new hires, role templates approved by each department with IT and security control the scope. The agent stops at once when information does not match. Anything outside the template, and sensitive access involving money or data, goes to human approval.
When lawyers and in-house counsel use legal research AI to find similar cases and precedents, they cannot paste the model's summaries or case numbers straight into a complaint, a defense brief, or a legal opinion. Every case they plan to cite must be checked against the original text and its later appeal history on an official public platform or a licensed database.
Developers who run coding agents locally rely on a local agent sandbox to limit file system access. Write access defaults to the project directory and temp paths. Read access is broader, so credential files need a separate block. Outbound requests pass through a domain allowlist. Before rollout, verify the isolation by running a command the sandbox should block.
You can run Android apps on a Mac with Mac.apk. It needs macOS 26.4 or later and Apple Silicon, and it has no sandbox. Before approving it, check 6 items: signing and notarization, entitlements, shared folders, rebuild from source, network calls and reporting, and uninstall and rollback. This note also gives our reasons for not installing it and the conditions for a trial.
To choose an Agent sandbox, first decide what you are isolating. To limit a coding Agent's reads, writes, and network access on your own machine, use a process-level tool such as sandbox-runtime. To run untrusted code, run batch evals, or serve many users, use a full runtime with separate containers or virtual machines, such as OpenSandbox.
Run a private Codex gateway on official API keys: deploy LiteLLM with Docker Compose behind HTTPS, issue one key per employee with budgets, and log usage.
Agent authentication: carry employee and agent IDs on every call, and grant only the overlap of gateway and employee rights to stop shared-account abuse.
AI agent security governance: Deloitte finds 23% of firms use agents at least moderately, 74% expected in two years, only 21% rate governance mature.
Agents on shared workflows belong to the process owner. When the builder leaves, swap credentials, check triggers, clear private memory; if unowned, freeze it.
Agent pilots run on clean data with engineers watching. Production brings messy data, cross-system writes, and real consequences. Five checks before you scale.
AI agent permissions: relax approval for mail search and summaries; require approval for sends and calendar edits until a permission table exists.
An AI agent took a wrong action. Stop it and revoke credentials in hour one, roll back by action type, replay the action log, and assign accountability by role.
Agent testing: run agents in a mock company with mock APIs and MCP endpoints before CRM access, then retest with real data in staging before launch.
Agent management starts with an inventory: purpose, owner, systems, credentials, triggers, last run. Tier by risk and disable unowned agents.
Multi-agent security: handoffs may carry malicious content. Verify the originator, limit actions, block internal addresses, approve risky writes.
Agent permission management by impact: reads first, then drafts and capped writes. Humans approve external actions, payments and irreversible steps.
China's GB/T 47746-2026 took effect Sept 1, 2026. AI agents may answer order questions; refunds, discounts, and compensation need human or formal sign-off.
Models can make dozens of AI video ads a day; fewer pass brand and platform review. China's labeling rules, Google's AI ad labels, and a pre-scale review gate.
China's AI content labeling rules took effect 2025-09-01. An ad legal ledger needs source, generation process, and license fields, plus who logs each one.
CISA's acting director uploaded a For Official Use Only contract to public ChatGPT. Consumer plans may train on inputs. Redact names, amounts, and seals first.
Codex and Claude Code spend on personal keys won't match finance. Who reconciles, which log fields to keep, and why only gateway-issued credentials work.
First touches, pricing, key accounts, and unclear context go to a human. Routine follow-ups send by rule, with checks on frequency, opt-outs, and approval logs.
Run an enterprise AI pilot in one department on one scored workflow with written go/stop criteria. Giving every employee an AI account first is not a pilot.
Before enabling Grok Bot company-wide, decide who gets access, how approvals are enforced, and what the Audit Log and Action Recording each actually capture.
All Grok Bots on one Cursor account share one cloud computer, files and logins included. Each Bot's screen is a work surface, not a security boundary.
MCP security risks: before connecting a third-party MCP server, check its run-as account, input paths, authentication, maintenance and key rotation.
An LLM API gateway gives all of a company's AI calls one entry point for authentication, routing, rate limiting, audit, model fallback, and cost logs.
When every employee buys their own AI account, nobody can see who uses which model or what data leaves. Companies need one trusted relay or gateway instead.
A practical guide to third-party LLM router risk, malicious model output, Agent Full Access, credential theft, sandboxing, and self-managed LLM gateways.
Free. Remote, over video.
