Notes on secure systems design, agent identity, runtime isolation, and policy-governed autonomous defense.
Benchmarks test whether an agent can be tricked. Almost nothing tests whether the runtime holds once it has been. I built a small conformance suite to measure containment, and the hardest part was stopping the tool from lying to me.
Autonomous defense should not mean letting an AI agent freely fix production. It means a policy-governed system that detects risk, reasons about impact, proposes remediation, executes only low-risk actions, and escalates everything else with full auditability.
How to structure identity, delegation, and authorization when your tenants are autonomous agents running on shared infrastructure.
How to replace scattered security logic with a unified, testable policy layer using Open Policy Agent and Rego — applied to cloud infrastructure, Kubernetes, and autonomous agent systems.