Permissions, not prompts, scope what an agent can do, which is what makes the service account the right unit of analysis. New Federal Reserve guidance for banks tests exactly that distinction: examiners now probe whether an agent can actually be switched off, not just instructed to stop. Most organizations can't currently answer that question for their own agents, coding or otherwise: a CLAUDE.md line reading "never touch production" sits in the same unverified layer as a kill switch nobody has tested.
The question above, about running this across many repos with different risk profiles, points at the harder version: a settings file scopes cleanly for one. What replaces it at fleet scale?
Instructions as a security boundary is how teams get burned. We split read / draft / execute tools and put a real gate on execute. If it can pay, write, or ship without a human yes, it isn't "careful." It's unfinished.
thanks again for the collab Jeff! awesome stuff here. and as always, anyone in the comments section feel free to AMA, i’ll be around!
Permissions, not prompts, scope what an agent can do, which is what makes the service account the right unit of analysis. New Federal Reserve guidance for banks tests exactly that distinction: examiners now probe whether an agent can actually be switched off, not just instructed to stop. Most organizations can't currently answer that question for their own agents, coding or otherwise: a CLAUDE.md line reading "never touch production" sits in the same unverified layer as a kill switch nobody has tested.
The question above, about running this across many repos with different risk profiles, points at the harder version: a settings file scopes cleanly for one. What replaces it at fleet scale?
Instructions as a security boundary is how teams get burned. We split read / draft / execute tools and put a real gate on execute. If it can pay, write, or ship without a human yes, it isn't "careful." It's unfinished.
What happens once you're not securing one repo but five, each with a different risk profile?