IT Admin for the AI Workforce — Sarthak Aggarwal, Decawork
Agent instructions are not security boundaries. Put identity, scoped capabilities, policy gates, audit receipts, and revocation outside the model before granting production access.
Agents that read untrusted content while holding private data and action rights can turn text into side effects. The talk contrasts **EchoLeak**, a zero-click Microsoft 365 Copilot chain, with the **Replit production-data incident**, where no attacker was required.
Treat every agent as a runtime identity acting for a named subject. Convert authenticated intent into a typed plan, give the executor short-lived capabilities, and place a deterministic policy gate before each tool call. Keep destructive approvals and revocation outside the model.
Agents that read untrusted content while holding private data and action rights can turn text into side effects. The talk contrasts **EchoLeak**, a zero-click Microsoft 365 Copilot chain, with the **Replit production-data incident**, where no attacker was required. Treat every agent as a runtime identity acting for a named subject. Convert authenticated intent into a typed plan, give the executor short-lived capabilities, and place a deterministic policy gate before each tool call. Keep destructive approvals and revocation outside the model. Privilege separation reduces authority; it does not make hostile context or model errors disappear. MCP and A2A provide communication rails, but the talk argues they do not supply ownership, delegation policy, or a complete audit trail.
This elevates agent security from sandboxing alone to identity and authority design: bind actions to a named subject, translate intent into typed plans, issue short-lived capabilities, and enforce deterministic policy before every tool call. It confirms runtime separation patterns while clarifying that MCP or A2A connectivity does not establish ownership, delegation, revocation, or auditability.