# Tethered: Our Agents Are Us — Shu Fang, Two Sigma

## Executive summary

Two Sigma implemented a framework allowing every employee to run cloud agents using their own unique user identity, addressing the challenges of permissions drift and maintaining security in a highly regulated environment. The solution leverages existing Kubernetes infrastructure (dedicated namespaces per person) and introduces two critical guardrails: propagating a trace header for full action provenance, and utilizing Google's web grounding for enterprise—a restricted search index that eliminates external egress vulnerabilities while accepting a data freshness constraint of up to 24 hours.

## Key takeaways

- Running Agents as User Identity: By running agents with the user's exact identity, the system bypasses conventional constraints like permissions drift and licensing issues associated with separate machine identities. This capability was supported by pre-existing infrastructure: a Kubernetes namespace per individual in every region, where automated jobs already ran using the user's identity via a sidecar mounting mechanism.
- Ensuring Action Provenance (Attribution): To differentiate between actions taken by the human and those performed by the agent, a dedicated header is propagated throughout the system. This trace ID allows for full provenance tracking, enabling the replay of the entire chain of actions leading to an end result, which is superior to simple identity verification.
- Securing Web Access with Grounding: To mitigate risks like exfiltration and prompt injection from open web access, the firm adopted Google's 'web grounding for enterprise.' This service provides search and fetch capabilities within the internal VPC network boundary, while blocking native tools (e.g., Brave web browser) to ensure all requests route through the controlled index.

## Technical details

- Infrastructure Architecture: The system relies on a Kubernetes cluster structure, utilizing dedicated namespaces for each user/individual in every region. Automated jobs and containers operate by having a sidecar within the pod pull down and mount the specific user's identity into the container.
- Identity Management: The core mechanism allows agents to run as the exact user identity, maintaining all associated capabilities and access rights while eliminating previous constraints related to multiple interacting identities (e.g., Google Workspace).
- Observability and Tracing: Provenance is maintained by propagating a specialized header (similar to a trace ID) across all system components. This ensures that the full, re-playable chain of actions—not just the final actor identity—is recorded.
- Web Access Control: Access is restricted using 'web grounding for enterprise,' which provides search and fetch capabilities internally. The risk of external egress vulnerabilities is mitigated by explicitly denying native web tools and forcing all requests through the controlled, cached index.

## Practical implications

- Enterprises can achieve advanced agentic capabilities (running agents as users) while significantly reducing security risks by implementing mandatory provenance tracking and controlled web access.
- The infrastructure requires robust identity services capable of mounting user identities into compute pods (e.g., via sidecars).
- Implementing a dedicated trace header mechanism is crucial for auditing, ensuring that the full sequence of actions can be attributed to either the human or the agent.

## Topics

Generative AI, Agentic Systems, Cloud Security, Kubernetes, Observability, Hedge Funds/Finance Tech, Kubernetes namespace, Sidecar container, Google's web grounding for enterprise

Source: https://www.youtube.com/watch?v=wCIYViPd4SU