security

A few months ago, I set out to explain how to secure agent delegation with IAM. I ended with an uncomfortable conclusion: it might not be possible at all.

In my last post, I showed that static permissions can’t track dynamic intent. We decompose tasks across agents, but authority stays consolidated. The gap is real.

Today I’ll make some enemies.…

We isolate what an AI agent knows. Context windows. RAG. Memory scoping.

We haven’t figured out how to isolate what an agent can do.