Home / The five desks / Agent security & policy: the desk

A desk

Agent security & policy: the desk

For security leads, risk owners and boards deciding what an agent may do and who carries the risk.

38 articles on this desk, 23 more that touch it. Placed by rule from the subjects and topics of each article (articles/find.json); the editor can override a call, and says why.

Start here

Three pieces, in order, for a first visit to this desk.

  1. Every risk is already accepted. The only question is by whom, and for how long. 2026-09-24 · 15 min · Analysis
    Start with the idea the rest stands on: a risk exists the moment the exposure does, so the only question is who accepted it.
  2. Footprint and blast radius: what the agent actually did, and what it would have cost 2026-10-02 · 15 min · Explainer
    Then the two words this desk uses most, defined: what an agent did, and what its reach could cost.
  3. Six agents, one inbox: what a real multi-agent setup taught me about access policies 2026-09-29 · 16 min · Field report
    A real six-agent setup, rule by rule, graded by what actually enforces each one today.
  4. Hope or enforcement: one customer service agent, three designs, and who keeps each promise 2026-10-08 · 12 min · Field report
    The argument measured: one customer service agent built three ways, and how much of each policy is only hope.
  5. Authority outside the model: an answer to Satya Nadella on models as insider risks, principle by principle, with what we run, what we ship and what we plan 2026-10-11 · 20 min · Answer
    Where the desk had got to by 11 October: Satya Nadella's seven principles, answered with what runs and what is still design.

Series

Two or more articles that tell one story in order.

Answering Satya Nadella · 2 parts · 35 min

Satya Nadella on models as insider risks: answered principle by principle, then retold in our own vocabulary, on 11 October.

  1. Authority outside the model: an answer to Satya Nadella on models as insider risks, principle by principle, with what we run, what we ship and what we plan 2026-10-11 · 20 min · Answer
    The answer: seven principles, what runs, what is design, and five things the list leaves out.
  2. The same argument, in our words: Satya Nadella on models as insider risks, translated into the language of RiskMandate 2026-10-11 · 15 min · Answer
    The translation: the same case in the language of reach, mandate, gap and barriers.

Behaviour policy, from argument to gate · 4 parts · 47 min

Four days, 7 to 10 October: the policy is the business logic, then measured, then enforced on every draft, then kept alive through every summary.

  1. Zoom into an agent's behaviour policy and you find the business logic 2026-10-07 · 9 min · Analysis
    The argument: zoom into the policy and you find the business.
  2. Hope or enforcement: one customer service agent, three designs, and who keeps each promise 2026-10-08 · 12 min · Field report
    The measurement: one agent built three ways, and how much of each policy is hope.
  3. A second reader the agent cannot skip: how two wrong emails became a gate on every draft 2026-10-09 · 14 min · Field report
    The first gate: a second model approves every draft, failing closed.
  4. Re-anchoring: keeping an agent's rules alive through every summary, and a canary that shows when they are not 2026-10-10 · 12 min · Field report
    Keeping it alive: the rules printed back after every summary, with a canary.

Every article on this desk

  1. The tokens hook: a token behaviour policy that shows what every session reads, caches, writes and costs, why a prompt cannot do it, and a brief for tokens.hook.sgit.ai 2026-10-15 · 10 min · Analysis
    A token behaviour policy as a 132-line hook: the user sees what each session reads, caches and costs; a prompt cannot do it.
  2. Cedar and the policy vault: a debrief on the policy language agents are adopting, where our behaviour policies and sgit vaults meet it, and a brief for the MVP 2026-10-14 · 12 min · Analysis
    Cedar is mature and adopted; it lacks the why, the version in force and the evidence. A vault carries all three, and the demo shows it working.
  3. Commander's intent is a behaviour policy: Sondera's argument in our words, the business layer above it, and five of our rules compiled to Cedar and tested 2026-10-14 · 10 min · Analysis
    Sondera's commander's intent and our behaviour policies are one idea: twelve terms joined, the business layer above, and five rules tested in Cedar.
  4. A skill behaviour policy: what a skill says it does, what it can do, what it is given, and the control that closes the gap, measured on 899 skills 2026-10-14 · 10 min · Analysis
    A skill behaviour policy compares what a skill says, what it can do and what it is given, then generates the control; measured on 899 skills.
  5. Hooks are kernel code: a maturity model, the first ten hooks mapped, and a brief for a hooks site and feed where you pay for state, never to run 2026-10-14 · 10 min · Analysis
    Hooks are small code with kernel reach: a maturity model, the first ten hooks mapped, and a brief for a hooks site where you pay for state, never to run.
  6. System prompts as behaviour policies: Claude's published prompt and a leaked ChatGPT one, mapped into rows, a taxonomy of rules, and a JSON file a harness could enforce 2026-10-14 · 11 min · Analysis
    Claude's published system prompt as 82 policy rows in eight kinds: 36 could be held by the harness, 21 partly by classifiers, 25 stay with the model.
  7. Are hooks the sweet spot? Moving an agent's rules from hope into hooks, rule by rule, until enforcement moves off the machine 2026-10-14 · 10 min · Analysis
    One agent's eleven rules, moved from the prompt into hooks and tested: four fully, two mostly, three partly, two not at all, and a gap in the leak scan.
  8. Agent hooks in October 2026: a technical debrief on what each platform lets you see, stop and change, where hooks run, and where they fail 2026-10-14 · 9 min · Analysis
    A debrief on agent hooks across ten platforms: what each can see, stop and change, where they run, and the failure modes every vendor admits.
  9. A policy for every skill: Sean Turner's natural-language control for agent skills, the behaviour policy behind it, and using models to need them less 2026-10-14 · 9 min · Analysis
    Sean Turner's natural-language control for agent skills, read as a behaviour policy, and why the description, not the code, stays canonical.
  10. Policy as code needs a policy first: what an agent behaviour policy adds, and how to reverse engineer one from the code, the spreadsheet or the paper you already have 2026-10-14 · 11 min · How-to
    Policy as code answers one question. An agent behaviour policy holds the rest, and can be generated into code or reverse engineered from it.
  11. Attacks rewritten as mandates: 28 supply-chain incidents, the column each one was missing, and why the next maintainer is an agent 2026-10-13 · 12 min · Analysis
    28 supply-chain attacks read as reach beyond mandate: what a hardened registry stops, what only a written mandate can, and why agents change it.
  12. Four frameworks, one agent: iason's comparison of the OECD classification, the NIST AI RMF, Japan's guidelines and the EU AI Act, read against what runs here, with the evidence and the graphs 2026-10-13 · 22 min · Analysis
    iason's comparison of four AI risk frameworks, mapped to the behaviour policy, the footprint and the graphs that run here, with the status of each row.
  13. The human in the loop is a spectrum: how cheap it is to undo decides where a person belongs, and why the newsroom ships on its own while my email still waits for me 2026-10-13 · 8 min · Analysis
    How much to let an agent ship on its own depends on how cheap it is to undo and how mature the controls are, and both of those move.
  14. The human in the loop, safety net or bottleneck: both, until you decide which outputs need a person and give that person the why 2026-10-13 · 9 min · Analysis
    Checking every output is a bottleneck and a weak safety net; put the person where it cannot be undone, and let controls do the rest.
  15. A policy beside the prompt: a proposal that every agent takes a behaviour policy as an input, with enforcement and liability attached, and why aviation and payments say the vendors should want it 2026-10-13 · 17 min · Analysis
    A proposal: every agent takes a behaviour policy beside its prompt, which the vendor accepts and answers for, as aviation and payments learned to.
  16. The policy draws the liability line: an answer to Ralf Thomas on agent accountability, and why every agent in a loop should take a behaviour policy beside its prompt 2026-10-13 · 11 min · Answer
    An answer to Ralf Thomas: the shell game works because nothing is written down, and a behaviour policy's explicit prohibitions move the liability line.
  17. Stop the bleeding, then ask for it back: a helper, an agent and a friendly letter for the subscriptions you keep and do not use 2026-10-13 · 18 min · Analysis
    A helper and an agent ask what you used, ask nicely for a pause and a refund, stop the payments either way, and publish what each company did.
  18. Who owns the words: agents can make decisions, but they cannot hold responsibility 2026-10-12 · 11 min · Analysis
    Agents in loops make real decisions, but responsibility stays with whoever granted the reach; disclosure is a label, not a team to manage.
  19. How the voice works: why these articles sound like me, with a section in which Claude explains it from its side 2026-10-12 · 10 min · Analysis
    Why these articles sound like their author: a corpus, the voice memos, seven wording rules and a reader who corrects, with Claude explaining it from its side.
  20. The vault is live: from a design on 11 October to a reader's vault on newsroom.sgit.ai by two in the morning, and how all of it fits together 2026-10-12 · 13 min · Analysis
    The reader's vault runs on newsroom.sgit.ai: a passkey opens three real vaults, each device writes one file, and the architecture is drawn as it stands.
  21. Where the platform draws the line: Microsoft Execution Containers, the shared responsibility model for agents, and the business logic above it 2026-10-11 · 19 min · Explainer
    Microsoft's MXC and ACS, briefed field by field and mapped to Agent Behaviour Policies: the platform bounds what it can see; the business logic is above.
  22. The same argument, in our words: Satya Nadella on models as insider risks, translated into the language of RiskMandate 2026-10-11 · 15 min · Answer
    Satya Nadella's case for treating models as insider risks, translated idea by idea into our vocabulary: reach, mandate, gap, barriers and accepted risk.
  23. Authority outside the model: an answer to Satya Nadella on models as insider risks, principle by principle, with what we run, what we ship and what we plan 2026-10-11 · 20 min · Answer
    Satya Nadella's seven principles for models as insider risks, answered one by one: what we run, what is design, and the five things the list leaves out.
  24. The AI governance stack, as a graph: an answer to Hari Kota, built 2026-10-09 · 15 min · Answer
    Hari Kota's ten-layer AI governance stack, kept as posted and turned into a fractal semantic graph: the gaps become missing edges, and queries.
  25. Agency is not a yes: a scale for human and agent decisions, from rubber stamp to the reviewer who fixes the source 2026-10-08 · 13 min · Analysis
    A yes or no is not agency: seven dimensions, a seven-level scale for people and agents, and the review as a QA step that fixes the source.
  26. Hope or enforcement: one customer service agent, three designs, and who keeps each promise 2026-10-08 · 12 min · Field report
    One customer service agent built three ways, each with an Agent Behaviour Policy: how much of each policy is hope, and what one run can reach.
  27. Who are you protecting against? Draw the security line where the attacker is, not above it 2026-10-08 · 12 min · Analysis
    Before deciding how secure to be, name the attacker: a six-tier ladder, an air-gapped Mac mini read against it, and eight startups drawing their line.
  28. Zoom into an agent's behaviour policy and you find the business logic 2026-10-07 · 9 min · Analysis
    Below the first rules, an agent's behaviour policy is the business: functions, processes, clients, values. Layered, owned, counted, and where vendors plug in.
  29. An open AI governance framework, and what its licence let us build 2026-10-07 · 14 min · Analysis
    Twenty open AI governance controls under CC BY-SA, why the licence matters, and the same day's conversion into a graph, a database and a walk down to EU law.
  30. Where is the why? A permission prompt asked me to decide, and kept the reason 2026-10-07 · 15 min · Field report
    A prompt asked for a decision and kept the reason. Read through the policy, the law on uninformed consent, and the fixes that worked: put the why in the prompt.
  31. The investigation GitHub owes its customers: why a global outage of a platform the world deploys through deserves an aviation-style inquiry, and how the evidence could now be gathered 2026-10-05 · 21 min · Analysis
    A global GitHub Actions outage read the way aviation reads an incident: independent inquiry, near-miss reporting, second and third stories, vaults for the evidence.
  32. Send an agent, not a spreadsheet: the next generation of software due diligence, and why the companies that stopped reading their code are about to be asked about it 2026-10-05 · 25 min · Analysis
    Due diligence never scaled because it was a form; a buyer can now send an agent into a vendor's environment and read what the code and the practices are.
  33. The identity we wanted to give the agents: a week of design, the line in Google's terms, and why login plus secrets is still too hard 2026-10-05 · 17 min · Field report
    A week of designing identities for agents and users met Google's terms; what survived is a passkey-unlocked keyring and a gap nobody sells.
  34. Footprint and blast radius: what the agent actually did, and what it would have cost 2026-10-02 · 15 min · Explainer
    Footprint is what an agent actually did, read afterwards from logs and vault history; blast radius is what a row of its reach would cost the business today.
  35. The ultimate insider: agents, the infrastructure that cannot hold them, and risk management that cannot keep up 2026-09-30 · 17 min · Analysis
    Agents, the infrastructure meant to contain them, and risk management run on spreadsheets are arriving at once, and together they are one scenario.
  36. Six agents, one inbox: what a real multi-agent setup taught me about access policies 2026-09-29 · 16 min · Field report
    An access policy for an agent is only as real as its worst row: every rule in a real six-agent setup, graded by how it is enforced today.
  37. Every risk is already accepted. The only question is by whom, and for how long. 2026-09-24 · 15 min · Analysis
    A risk exists the moment the exposure does, so somebody is already carrying it; the only questions worth asking are who has accepted it and until when.
  38. Before you give an agent a connector, give the connector a twin 2026-09-24 · 14 min · Explainer
    An agent with a Gmail or Calendar connector can do things the platform cannot undo; a journal of every call, replayed, shows what it did and what can go back.

Also touching this desk

Placed on another desk first; this one second.

Subjects on this desk

The controlled vocabulary: each subject belongs to one desk.

Behaviour policy · 47 Blast radius and footprint · 12 Prompt injection · 5 Insider risk · 3 Decisions and human review · 10 Risk and risk acceptance · 13 Threat modelling · 13 AI governance frameworks · 9 Regulation and law · 11 Incidents and resilience · 4 Identity and secrets · 10

For an agent

The Agent security & policy desk of newsroom.sgit.ai: For security leads, risk owners and boards deciding what an agent may do and who carries the risk. 38 articles placed here by rule, 2 series, three to start with. The data: https://newsroom.sgit.ai/articles/find.json (desks, vocabulary, series, formats and reading time for every article). Every desk: https://newsroom.sgit.ai/desks/index.html.