# IT Admin for the AI Workforce — Sarthak Aggarwal, Decawork

Source: [AI Engineer](https://www.youtube.com/watch?v=q-WOjZhOMCA)  
Feed7 permalink: https://feed7.dev/p/it-admin-for-the-ai-workforce-sarthak-aggarwal-decawork-0oxlc5t  
Published: 2026-08-20T14:30:38.000Z  
Trust: Source Linked (source_linked)

## Why Included

Agent instructions are not security boundaries. Put identity, scoped capabilities, policy gates, audit receipts, and revocation outside the model before granting production access.

## Source Summary

Agents that read untrusted content while holding private data and action rights can turn text into side effects. The talk contrasts **EchoLeak**, a zero-click Microsoft 365 Copilot chain, with the **Replit production-data incident**, where no attacker was required.

## Practical Implication

Treat every agent as a runtime identity acting for a named subject. Convert authenticated intent into a typed plan, give the executor short-lived capabilities, and place a deterministic policy gate before each tool call. Keep destructive approvals and revocation outside the model.

## Agent-Ready Context

Agents that read untrusted content while holding private data and action rights can turn text into side effects. The talk contrasts **EchoLeak**, a zero-click Microsoft 365 Copilot chain, with the **Replit production-data incident**, where no attacker was required.

Treat every agent as a runtime identity acting for a named subject. Convert authenticated intent into a typed plan, give the executor short-lived capabilities, and place a deterministic policy gate before each tool call. Keep destructive approvals and revocation outside the model.

Privilege separation reduces authority; it does not make hostile context or model errors disappear. MCP and A2A provide communication rails, but the talk argues they do not supply ownership, delegation policy, or a complete audit trail.

## Connected Context

Feed7 judgment across 525 accumulated Signals:

This elevates agent security from sandboxing alone to identity and authority design: bind actions to a named subject, translate intent into typed plans, issue short-lived capabilities, and enforce deterministic policy before every tool call. It confirms runtime separation patterns while clarifying that MCP or A2A connectivity does not establish ownership, delegation, revocation, or auditability.

- [In Code They Act, In Proof We Trust — Erik Meijer, Leibniz Labs](https://feed7.dev/p/in-code-they-act-in-proof-we-trust-erik-meijer-leibniz-labs-1lyno2y) — Both separate planning from side effects and require a machine-enforced gate before execution; this talk adds subject identity, short-lived delegation, and revocation requirements.
- [Unlock Agent Autonomy: The Runtime for AI-Native Systems — Tushar Jain, Docker](https://feed7.dev/p/unlock-agent-autonomy-the-runtime-for-ai-native-systems-tushar-jain-dock-0wg72se) — Docker’s external capability approval and task containment implement the same principle that authority decisions must remain outside the agent’s trust boundary.
- [zhaoxuya520/reverse-skill](https://feed7.dev/p/reverse-skill-1e4jlfw) — The security router’s authorization-first planning and evidence trail align with typed intent and auditing, while this talk demands stronger runtime identity and per-call capability enforcement.
- [Stop AI Agent Hallucinations: 5 Techniques + Production Patterns - Elizabeth Fuentes, AWS](https://feed7.dev/p/stop-ai-agent-hallucinations-5-techniques-production-patterns-elizabeth-09g1w9s) — Pre-call rule enforcement supports the deterministic policy-gate requirement, while typed plans and delegated identities extend it beyond response validation and runtime correction.

## Context Map

- Layer: agent
- Domains: coding, security
- Topics: harness-engineering, tool-use, sandboxing

## Uncertainty

- Privilege separation reduces authority; it does not make hostile context or model errors disappear. MCP and A2A provide communication rails, but the talk argues they do not supply ownership, delegation policy, or a complete audit trail.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.