The Video Signal

Topic

Cloud Security

All digests tagged Cloud Security

Tethered: Our Agents Are Us — Shu Fang, Two Sigma thumbnail

· 21:10

Tethered: Our Agents Are Us — Shu Fang, Two Sigma

Two Sigma implemented a framework allowing every employee to run cloud agents using their own unique user identity, addressing the challenges of permissions drift and maintaining security in a highly regulated environment. The solution leverages existing Kubernetes infrastructure (dedicated namespaces per person) and introduces two critical guardrails: propagating a trace header for full action provenance, and utilizing Google's web grounding for enterprise—a restricted search index that eliminates external egress vulnerabilities while accepting a data freshness constraint of up to 24 hours.

Key takeaways

  1. Running Agents as User Identity 2:00

    By running agents with the user's exact identity, the system bypasses conventional constraints like permissions drift and licensing issues associated with separate machine identities. This capability was supported by pre-existing infrastructure: a Kubernetes namespace per individual in every region, where automated jobs already ran using the user's identity via a sidecar mounting mechanism.

  2. Ensuring Action Provenance (Attribution) 8:37

    To differentiate between actions taken by the human and those performed by the agent, a dedicated header is propagated throughout the system. This trace ID allows for full provenance tracking, enabling the replay of the entire chain of actions leading to an end result, which is superior to simple identity verification.

  3. Securing Web Access with Grounding 9:18

    To mitigate risks like exfiltration and prompt injection from open web access, the firm adopted Google's 'web grounding for enterprise.' This service provides search and fetch capabilities within the internal VPC network boundary, while blocking native tools (e.g., Brave web browser) to ensure all requests route through the controlled index.

Watch on YouTube Full article

Multiplayer agentic engineering — Arjun Singh, Superconductor thumbnail

· 18:44

Multiplayer agentic engineering — Arjun Singh, Superconductor

The talk outlines 'multiplayer agentic engineering,' focusing on how human teams and AI agents can collaborate effectively across diverse systems. Key recommendations include making workflows model-agnostic, integrating agents into every human interface (Slack, GitHub), ensuring work visibility via artifacts, and treating all external signals (emails, meetings) as code inputs. Crucially, the speaker emphasizes that these advanced agentic workflows must operate within isolated cloud environments to enforce least privilege and prevent data exfiltration.

Key takeaways

  1. Model Agnosticism is Critical 5:01

    Do not rely on a single LLM or harness, as the best model changes frequently. Utilizing open-weight models (like GLM 5.2) allows teams to stay in control of costs and maintain workflow continuity.

  2. Agent Interfaces Must Be Universal 6:48

    Agents should not be trapped on a single laptop or platform (e.g., Slack). The agent session must maintain context when moving between relevant interfaces like Slack, the desktop app, and GitHub.

  3. External Signals Must Become Code 10:10

    Treat all external signals—customer calls, meetings (e.g., a Google Meet bot), bug reports from Sentry, or emails—as inputs that can automatically trigger and prioritize work for the coding agent.

  4. Work Must Be Visible Everywhere 9:09

    To improve collaboration, agents should make their work visible across all platforms using standardized artifacts (screenshots or videos), eliminating context switching.

  5. Use Isolated Cloud Environments 12:22

    Running agents in a cloud sandbox is essential for security, enabling non-technical staff to trigger real work without having development environments on their local machines. This enforces the principle of least privilege.

Watch on YouTube Full article