# Tethered: Our Agents Are Us — Shu Fang, Two Sigma

Source: [AI Engineer](https://www.youtube.com/watch?v=wCIYViPd4SU)  
Feed7 permalink: https://feed7.dev/p/tethered-our-agents-are-us-shu-fang-two-sigma-0c8u33i  
Published: 2026-09-03T14:30:21.000Z  
Trust: Source Linked (source_linked)

## Why Included

Two Sigma runs remote agents under each employee’s real identity, adding trace propagation and controlled web access to preserve attribution and limit egress risk.

## Source Summary

At Two Sigma, **every employee** has provisioned cloud-agent infrastructure, and agents run with the employee’s identity rather than a separate service account. A propagated trace ID distinguishes agent activity and preserves the action chain while permissions remain tied to the user.

## Practical Implication

Builders deploying agents inside companies should reuse identity, namespaces, network controls, and tracing already present in the platform. Two Sigma routes search and fetch through **Web Grounding for Enterprise** inside its network boundary instead of giving agents unrestricted outbound access.

## Agent-Ready Context

At Two Sigma, **every employee** has provisioned cloud-agent infrastructure, and agents run with the employee’s identity rather than a separate service account. A propagated trace ID distinguishes agent activity and preserves the action chain while permissions remain tied to the user.

Builders deploying agents inside companies should reuse identity, namespaces, network controls, and tracing already present in the platform. Two Sigma routes search and fetch through **Web Grounding for Enterprise** inside its network boundary instead of giving agents unrestricted outbound access.

That index trades freshness for control: the talk reports data within **24 hours**, or **6 hours** for frequently updated sites. Curated retrieval reduces exposure but cannot eliminate prompt injection, and shared identity still requires reliable attribution and policy enforcement.

## Connected Context

Feed7 judgment across 691 accumulated Signals:

This grounds enterprise agent deployment in existing employee identity and platform controls rather than separate agent accounts. It complements the candidates’ sandbox focus with an attribution model: permissions stay user-scoped while trace IDs distinguish delegated activity. Controlled web grounding further narrows outbound access, but introduces a measurable freshness tradeoff and leaves prompt injection and policy enforcement unresolved.

- [Agent Runs now available in the Vercel MCP and CLI](https://feed7.dev/p/agent-runs-vercel-mcp-cli-06cfo04) — Vercel’s reasoning and tool-call traces complement Two Sigma’s propagated trace IDs by showing how attributed agent activity can become inspectable production evidence.
- [From fork() to Fleet: Designing an Agent Sandbox Cloud — Abhishek Bhardwaj, OpenAI](https://feed7.dev/p/from-fork-to-fleet-designing-an-agent-sandbox-cloud-abhishek-bhardwaj-op-0np9ki3) — The sandbox-cloud design supplies process isolation, persistence, and recovery beneath Two Sigma’s identity-based controls; together they cover different security boundaries rather than substituting for one another.
- [Gemini API Managed Agents: 3.6 Flash, hooks, and more](https://feed7.dev/p/expanding-managed-agents-gemini-api-3-6-flash-hooks-0xce1pm) — Gemini’s sandbox hooks and token caps offer concrete policy enforcement points for the user-scoped permissions and controlled execution model described here, while its reused environments add separate drift and cleanup risks.
- [Cloud agents start 3x faster with builds](https://feed7.dev/p/builds-1x27f44) — Cursor’s prepared snapshots reinforce reuse of managed platform infrastructure for cloud agents, but its stale-image fallback parallels the freshness tradeoff Two Sigma accepts in curated web retrieval.

## Context Map

- Layer: infra
- Domains: coding, security
- Topics: cloud-agents, observability, sandboxing

## Uncertainty

- That index trades freshness for control: the talk reports data within **24 hours**, or **6 hours** for frequently updated sites. Curated retrieval reduces exposure but cannot eliminate prompt injection, and shared identity still requires reliable attribution and policy enforcement.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.