Tethered: Our Agents Are Us — Shu Fang, Two Sigma
Two Sigma runs remote agents under each employee’s real identity, adding trace propagation and controlled web access to preserve attribution and limit egress risk.
At Two Sigma, **every employee** has provisioned cloud-agent infrastructure, and agents run with the employee’s identity rather than a separate service account. A propagated trace ID distinguishes agent activity and preserves the action chain while permissions remain tied to the user.
Builders deploying agents inside companies should reuse identity, namespaces, network controls, and tracing already present in the platform. Two Sigma routes search and fetch through **Web Grounding for Enterprise** inside its network boundary instead of giving agents unrestricted outbound access.
At Two Sigma, **every employee** has provisioned cloud-agent infrastructure, and agents run with the employee’s identity rather than a separate service account. A propagated trace ID distinguishes agent activity and preserves the action chain while permissions remain tied to the user. Builders deploying agents inside companies should reuse identity, namespaces, network controls, and tracing already present in the platform. Two Sigma routes search and fetch through **Web Grounding for Enterprise** inside its network boundary instead of giving agents unrestricted outbound access. That index trades freshness for control: the talk reports data within **24 hours**, or **6 hours** for frequently updated sites. Curated retrieval reduces exposure but cannot eliminate prompt injection, and shared identity still requires reliable attribution and policy enforcement.
This grounds enterprise agent deployment in existing employee identity and platform controls rather than separate agent accounts. It complements the candidates’ sandbox focus with an attribution model: permissions stay user-scoped while trace IDs distinguish delegated activity. Controlled web grounding further narrows outbound access, but introduces a measurable freshness tradeoff and leaves prompt injection and policy enforcement unresolved.