[{"data":1,"prerenderedAt":350},["ShallowReactive",2],{"$fhr8loVjMP5l15yYpN-eUjdHYr1cXKNDA6p1sqJT8u80":3},{"item":4},{"id":5,"title":6,"article":7,"articleStatus":8,"articleUrl":9,"author":10,"body":11,"deliverables":330,"description":10,"designer":333,"driveFolder":334,"extension":335,"imagesFolder":336,"kind":337,"liveUrl":338,"meta":339,"navigation":340,"nextAction":341,"outcome":338,"owner":342,"path":343,"phase":344,"postSlug":10,"seo":345,"status":346,"stem":347,"targetDate":10,"updated":348,"__hash__":349},"briefs\u002Fbriefs\u002Ftreat-your-agents-like-insiders.md","Treat your agents like insiders","Treat Your Agents Like Insiders — third post in the agent-security series","draft","https:\u002F\u002Fdocs.google.com\u002Fdocument\u002Fd\u002F11oqNGEn2gtYSHMiw9g5Hs3GiCBZXQHYW4dNcU2bqu0I\u002Fedit","",{"type":12,"value":13,"toc":323},"minimark",[14,19,23,27,30,37,40,52,56,309,313],[15,16,18],"h2",{"id":17},"in-plain-words","In plain words",[20,21,22],"p",{},"A new worker gets the same keys, badge and computer login as the person who hired them. That makes them an insider: they can do real damage without meaning to, by following a bad note or trusting a broken tool. Companies learned long ago not to let insiders watch themselves. Someone else holds the access log, sets the limits, and can take the badge away. The article says AI helpers deserve exactly that treatment, and that the watcher has to sit somewhere the helper can't reach: not inside the helper, not in its uniform, but underneath, in the floor.",[15,24,26],{"id":25},"the-article-in-three-lines","The article in three lines",[20,28,29],{},"An agent on a laptop runs with that developer's credentials, keys and repos, so it is an insider: not malicious, but capable of bad calls at machine speed with full access. Insiders don't police themselves, and the security design for that has a name since the 1970s, the reference monitor: it checks every access, the thing it controls can't tamper with it, and it is small enough to verify. So the controls can't live inside the agent or its harness; they sit underneath, and the insider playbook (identity, limited privileges, a record the agent can't change, containment, judgment) runs there on every action.",[20,31,32,33],{},"The line that wants to be the picture: ",[34,35,36],"em",{},"\"The controls can't live inside the agent or its harness. They have to sit underneath it, where the agent can't reach them.\"",[20,38,39],{},"Third of three in the series. It opens on a Satya Nadella remark about frontier models as insider risk, and it cites the other two posts, so it closes the set. The series decision on the sandbox brief applies here.",[20,41,42,43,47,48,51],{},"The author's figures in the folder: ",[44,45,46],"code",{},"inside-vs-underneath"," and ",[44,49,50],{},"insider-playbook",", each in light and dark. The hero should not redraw either.",[15,53,55],{"id":54},"jargon","Jargon",[57,58,59,75],"table",{},[60,61,62],"thead",{},[63,64,65,69,72],"tr",{},[66,67,68],"th",{},"Term",[66,70,71],{},"What it means here",[66,73,74],{},"If you had to draw it",[76,77,78,90,101,112,133,144,155,166,177,188,199,210,221,232,243,254,265,276,287,298],"tbody",{},[63,79,80,84,87],{},[81,82,83],"td",{},"Agent",[81,85,86],{},"An AI program that works through a goal on its own, with whatever access its user has.",[81,88,89],{},"The new worker",[63,91,92,95,98],{},[81,93,94],{},"Insider \u002F insider risk",[81,96,97],{},"Someone trusted with access who could cause harm, through malice or mistake. The article's frame, borrowed from a Satya Nadella remark.",[81,99,100],{},"A worker with a full key ring (not a villain; the brand says no dramatizing)",[63,102,103,106,109],{},[81,104,105],{},"Frontier model",[81,107,108],{},"The most capable AI models of the moment.",[81,110,111],{},"Background only",[63,113,114,127,130],{},[81,115,116,117,120,121,120,124],{},"Credentials, ",[44,118,119],{},"~\u002F.aws\u002Fcredentials",", ",[44,122,123],{},"~\u002F.ssh",[44,125,126],{},".env",[81,128,129],{},"Files holding passwords and keys. The access the agent inherits.",[81,131,132],{},"A key ring",[63,134,135,138,141],{},[81,136,137],{},"Harness",[81,139,140],{},"The app the agent runs in (Claude Code, Codex, Cursor), with its own permission settings.",[81,142,143],{},"The worker's uniform",[63,145,146,149,152],{},[81,147,148],{},"Hooks, permission settings",[81,150,151],{},"Rules inside the harness. They see tool calls only and the agent can route around them.",[81,153,154],{},"A rule pinned to the uniform",[63,156,157,160,163],{},[81,158,159],{},"MCP server",[81,161,162],{},"A helper program giving the agent extra abilities; can be compromised.",[81,164,165],{},"A toolbox",[63,167,168,171,174],{},[81,169,170],{},"Reference monitor",[81,172,173],{},"A 1970s security design: something that checks every access, can't be tampered with by what it controls, and is small enough to verify. The article's standard.",[81,175,176],{},"A small, solid gate everything passes through",[63,178,179,182,185],{},[81,180,181],{},"\"Underneath the harness\"",[81,183,184],{},"Where Qpoint sits: between the program and the operating system, below the agent's reach.",[81,186,187],{},"A layer in the floor",[63,189,190,193,196],{},[81,191,192],{},"Operating system",[81,194,195],{},"macOS, Windows, Linux. The floor.",[81,197,198],{},"The ground",[63,200,201,204,207],{},[81,202,203],{},"Exec, file open, read, write, connect",[81,205,206],{},"The basic actions any program asks the operating system for.",[81,208,209],{},"One doorway",[63,211,212,215,218],{},[81,213,214],{},"Plugin",[81,216,217],{},"A separate program that applies the rules, outside the agent. If it crashes the agent keeps running.",[81,219,220],{},"A separate figure with the rulebook",[63,222,223,226,229],{},[81,224,225],{},"Hosted agent, service account, pod, CI runner, deploy keys",[81,227,228],{},"Agents running on servers under a machine identity, with secrets attached to the environment.",[81,230,231],{},"Workers in a warehouse with a shared badge",[63,233,234,237,240],{},[81,235,236],{},"SIEM",[81,238,239],{},"The central log and alerting system a security team uses.",[81,241,242],{},"A control room",[63,244,245,248,251],{},[81,246,247],{},"Containment, suspend, halt across the fleet",[81,249,250],{},"Stopping one agent, one machine, or every agent at once.",[81,252,253],{},"A hand on a big switch",[63,255,256,259,262],{},[81,257,258],{},"Fleet",[81,260,261],{},"All the agents a company runs, across all machines.",[81,263,264],{},"Many identical workers",[63,266,267,270,273],{},[81,268,269],{},"LLM judge",[81,271,272],{},"A language model asked to decide whether an action matches a plain-English policy when no written rule covers it. Doesn't enforce; the runtime does.",[81,274,275],{},"A referee consulted on hard calls",[63,277,278,281,284],{},[81,279,280],{},"Policy",[81,282,283],{},"What's allowed, written in plain words.",[81,285,286],{},"A note on the fridge",[63,288,289,292,295],{},[81,290,291],{},"Identity (agent, session, user, host)",[81,293,294],{},"The four labels attached to every action: which agent, which run, which person, which machine.",[81,296,297],{},"A name tag",[63,299,300,303,306],{},[81,301,302],{},"Logged activity \"captured underneath, not reported by\"",[81,304,305],{},"The record comes from the floor, not from the worker's own diary.",[81,307,308],{},"A ledger kept by someone else",[15,310,312],{"id":311},"record","Record",[314,315,316],"ul",{},[317,318,319],"li",{},[320,321,322],"strong",{},"Shipped:",{"title":10,"searchDepth":324,"depth":324,"links":325},2,[326,327,328,329],{"id":17,"depth":324,"text":18},{"id":25,"depth":324,"text":26},{"id":54,"depth":324,"text":55},{"id":311,"depth":324,"text":312},[331,332],"hero","listing","sarah","https:\u002F\u002Fdrive.google.com\u002Fdrive\u002Ffolders\u002F1PQSGuBmIjJwcCZxvoRzdu1ZnIpJ2vztd","md","\u002Fimages\u002F2026.Q4\u002F","illustration",null,{},true,"Direction conversation, Mark and Sarah, after the series system is decided on the sandbox brief.","Mark","\u002Fbriefs\u002Ftreat-your-agents-like-insiders","0-intake",{"title":6,"description":10},"queued","briefs\u002Ftreat-your-agents-like-insiders","2026-10-13","TOzlDWOM_hLWrkBMXHVTEZd0C5UQjd7sBVYFYqSV77o",1794599377688]