Treat your agents like insiders

The article is still being written. Its argument is settled enough to design against; its wording and figures may change.

In plain words

A new worker gets the same keys, badge and computer login as the person who hired them. That makes them an insider: they can do real damage without meaning to, by following a bad note or trusting a broken tool. Companies learned long ago not to let insiders watch themselves. Someone else holds the access log, sets the limits, and can take the badge away. The article says AI helpers deserve exactly that treatment, and that the watcher has to sit somewhere the helper can't reach: not inside the helper, not in its uniform, but underneath, in the floor.

The article in three lines

An agent on a laptop runs with that developer's credentials, keys and repos, so it is an insider: not malicious, but capable of bad calls at machine speed with full access. Insiders don't police themselves, and the security design for that has a name since the 1970s, the reference monitor: it checks every access, the thing it controls can't tamper with it, and it is small enough to verify. So the controls can't live inside the agent or its harness; they sit underneath, and the insider playbook (identity, limited privileges, a record the agent can't change, containment, judgment) runs there on every action.

The line that wants to be the picture: "The controls can't live inside the agent or its harness. They have to sit underneath it, where the agent can't reach them."

Third of three in the series. It opens on a Satya Nadella remark about frontier models as insider risk, and it cites the other two posts, so it closes the set. The series decision on the sandbox brief applies here.

The author's figures in the folder: inside-vs-underneath and insider-playbook, each in light and dark. The hero should not redraw either.

Jargon

Term	What it means here	If you had to draw it
Agent	An AI program that works through a goal on its own, with whatever access its user has.	The new worker
Insider / insider risk	Someone trusted with access who could cause harm, through malice or mistake. The article's frame, borrowed from a Satya Nadella remark.	A worker with a full key ring (not a villain; the brand says no dramatizing)
Frontier model	The most capable AI models of the moment.	Background only
Credentials, `~/.aws/credentials`, `~/.ssh`, `.env`	Files holding passwords and keys. The access the agent inherits.	A key ring
Harness	The app the agent runs in (Claude Code, Codex, Cursor), with its own permission settings.	The worker's uniform
Hooks, permission settings	Rules inside the harness. They see tool calls only and the agent can route around them.	A rule pinned to the uniform
MCP server	A helper program giving the agent extra abilities; can be compromised.	A toolbox
Reference monitor	A 1970s security design: something that checks every access, can't be tampered with by what it controls, and is small enough to verify. The article's standard.	A small, solid gate everything passes through
"Underneath the harness"	Where Qpoint sits: between the program and the operating system, below the agent's reach.	A layer in the floor
Operating system	macOS, Windows, Linux. The floor.	The ground
Exec, file open, read, write, connect	The basic actions any program asks the operating system for.	One doorway
Plugin	A separate program that applies the rules, outside the agent. If it crashes the agent keeps running.	A separate figure with the rulebook
Hosted agent, service account, pod, CI runner, deploy keys	Agents running on servers under a machine identity, with secrets attached to the environment.	Workers in a warehouse with a shared badge
SIEM	The central log and alerting system a security team uses.	A control room
Containment, suspend, halt across the fleet	Stopping one agent, one machine, or every agent at once.	A hand on a big switch
Fleet	All the agents a company runs, across all machines.	Many identical workers
LLM judge	A language model asked to decide whether an action matches a plain-English policy when no written rule covers it. Doesn't enforce; the runtime does.	A referee consulted on hard calls
Policy	What's allowed, written in plain words.	A note on the fridge
Identity (agent, session, user, host)	The four labels attached to every action: which agent, which run, which person, which machine.	A name tag
Logged activity "captured underneath, not reported by"	The record comes from the floor, not from the worker's own diary.	A ledger kept by someone else

Record

Shipped: