Tethered: Our Agents Are Us — Shu Fang, Two Sigma
Summary
Two Sigma implemented a framework allowing every employee to run cloud agents using their own unique user identity, addressing the challenges of permissions drift and maintaining security in a highly regulated environment. The solution leverages existing Kubernetes infrastructure (dedicated namespaces per person) and introduces two critical guardrails: propagating a trace header for full action provenance, and utilizing Google's web grounding for enterprise—a restricted search index that eliminates external egress vulnerabilities while accepting a data freshness constraint of up to 24 hours.
Key takeaways
-
Running Agents as User Identity
2:00
By running agents with the user's exact identity, the system bypasses conventional constraints like permissions drift and licensing issues associated with separate machine identities. This capability was supported by pre-existing infrastructure: a Kubernetes namespace per individual in every region, where automated jobs already ran using the user's identity via a sidecar mounting mechanism.
-
Ensuring Action Provenance (Attribution)
8:37
To differentiate between actions taken by the human and those performed by the agent, a dedicated header is propagated throughout the system. This trace ID allows for full provenance tracking, enabling the replay of the entire chain of actions leading to an end result, which is superior to simple identity verification.
-
Securing Web Access with Grounding
9:18
To mitigate risks like exfiltration and prompt injection from open web access, the firm adopted Google's 'web grounding for enterprise.' This service provides search and fetch capabilities within the internal VPC network boundary, while blocking native tools (e.g., Brave web browser) to ensure all requests route through the controlled index.
Technical details
-
Infrastructure Architecture
409s
The system relies on a Kubernetes cluster structure, utilizing dedicated namespaces for each user/individual in every region. Automated jobs and containers operate by having a sidecar within the pod pull down and mount the specific user's identity into the container.
-
Identity Management
120s
The core mechanism allows agents to run as the exact user identity, maintaining all associated capabilities and access rights while eliminating previous constraints related to multiple interacting identities (e.g., Google Workspace).
-
Observability and Tracing
707s
Provenance is maintained by propagating a specialized header (similar to a trace ID) across all system components. This ensures that the full, re-playable chain of actions—not just the final actor identity—is recorded.
-
Web Access Control
558s
Access is restricted using 'web grounding for enterprise,' which provides search and fetch capabilities internally. The risk of external egress vulnerabilities is mitigated by explicitly denying native web tools and forcing all requests through the controlled, cached index.
Mentioned resources
- Kubernetes namespace
- Sidecar container
- Google's web grounding for enterprise
Channel & topics
Watch on YouTube · Back to latest
This independent, AI-assisted summary is provided for commentary and informational purposes. It may contain errors or omit important context. Please watch the original video for the creator's complete presentation. Video, thumbnail, and related copyrights belong to their respective owners.