Your Agent's Capability Boundary Is Its Permission Boundary
Agent capability is set by the action surface you expose, not by the model you pick; therefore permission and sandbox design, not model selection, should be the primary design artifact for any agentic system, and teams that treat tools as an implementation detail will ship both unsafe and weak agents.
AngleReframe the standard 'which model?' engineering debate as a permission-scoping exercise, with a worked argument that a fixed model plus expanded tool surface outperforms a model upgrade with a fixed surface.
Source video ↗Guard Models Are a Layer, Not a Moat
Secondary-model validation ('automode') is valuable but structurally fragile: a guard weaker than the model it vets will be evaded at a rate that grows with primary-model capability, so guard models must be paired with process isolation, human gating, and continuous adversarial measurement rather than treated as the safety guarantee.
AngleArgue against safety architectures that consolidate trust in a single classifier, and specify what must sit behind the guard model for the claim of safety to be measurable.
Source video ↗Every Read Is an Authorization Decision
Giving an agent execution privileges turns content ingestion into a security boundary, so provenance tiering and content sanitization belong in the agent runtime, not in application code — and retrieval systems that cannot report where content came from are unsafe by construction.
AngleWalk through how the same channel that makes an agent useful (reading the web, docs, tool output) becomes the injection vector, and what runtime-level provenance metadata must look like.
Source video ↗When Generation Is Cheap, Verification Is the Bottleneck
Democratizing code generation to non-engineers does not remove engineering work; it relocates it into specification, acceptance criteria, and verification, and organizations that do not build verification infrastructure will accumulate unmaintainable systems faster than they can review them.
AngleChallenge the optimistic 'coding for everyone' framing by tracing where the review burden goes and why verification tooling becomes the limiting resource rather than authoring tooling.
Source video ↗Asymmetric Guard Evasion Harness
gatehouseA stronger working model can produce action plans that pass a weaker guard classifier while still satisfying an injected malicious objective, and evasion success rate increases monotonically as the capability gap between working model and guard model widens.
Proof of conceptTwo-model harness: a planner model receives task context containing an injected instruction and emits a tool-call plan; a guard model independently classifies each plan as benign/malicious; blocked plans are not executed in a sandboxed VM; record whether the malicious objective is achieved in the sandbox without the guard flagging it.
MeasurementAttack success rate (malicious objective achieved without guard block) across capability gaps and across injection placements, plus guard false-positive rate on matched benign tasks.
Source video ↗Permission-Surface Ablation for Repo Tasks
movement-labRepo-level task completion rate scales more with incremental tool/permission surface (read-only, write, bash, network) than with a model upgrade at a fixed surface, up to the point where added surface mainly increases incident risk rather than success.
Proof of conceptTake a fixed set of repo-level tasks, run them under a fixed model across graded permission tiers, then run them with an upgraded model at the lowest tier; log both completion and any unauthorized-scope actions taken during successful runs.
MeasurementTask completion delta per tier vs. per model upgrade, and unauthorized-action rate per tier among successful runs.
Source video ↗Provenance-Tiered Ingestion Gateway
gatehouseTagging ingested content by trust tier and neutralizing imperative/instruction-shaped spans before it enters agent context reduces injection success on browsing tasks by a measurable margin with no more than a small degradation in legitimate task success.
Proof of conceptMiddleware that labels each ingested chunk with provenance (first-party repo, user doc, external web, third-party tool output), applies tier-specific transformation, and enforces that low-trust content cannot directly parameterize write/bash calls without an out-of-band confirmation step.
MeasurementInjection success rate and legitimate-task success rate on a matched benchmark of browsing-plus-action tasks, with and without tiering enabled.
Source video ↗Safety Layer Coverage Matrix
beyond-evalsStatic evals, interpretability probes, and runtime classification target overlapping failure classes while leaving specific agentic failure modes (multi-step exfiltration, permission escalation across turns, cross-turn instruction carryover) uncovered by all layers.
Proof of conceptBuild a failure-mode taxonomy, construct minimal reproducible cases per mode, then run each case against each of the three safety layers independently and record which layer detects it and at what stage of the trajectory detection occurs.
MeasurementPer-failure-mode detection coverage matrix (layer x failure mode), redundancy index across layers, and count of failure modes with zero coverage.
Source video ↗