Andrey Rybka · AI Engineer · 15:44.

Give agents bounded authority

  • Use one identity per agent, with short-lived credentials limited to the intended service and task.
  • Authenticate agent-to-agent requests without allowing low-privilege agents to borrow a helper’s full authority.

Check actions outside the model

  • Route tool calls through deterministic permission and argument checks.
  • Require approval for consequential changes; budgets should halt activity when exceeded.
  • Treat instructions in email, documents and stored memory as potential hostile input.

Close the exits and separate the data

  • Default-deny outbound traffic includes DNS, not just web requests.
  • Enforce the tenant on every query and keep development authority separate from production.
  • Caveat: the incident stories are Rybka’s account; the talk does not independently validate every proposed control against each attack.

Make sure there are budgets that halt, not just alert.