Small Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th)

The core argument posits that the current approach to securing powerful, general-purpose AI agents—relying on external "cages" like containers, policy layers, and monitoring—is fundamentally flawed because it assumes reliable containment of evolving systems. Instead, a different security philosophy is advocated: leveraging agent capabilities to construct smaller, highly specialized, single-purpose agents that adhere rigorously to the principle of least privilege and separation of duties. This contrasts with granting broad access to a powerful model and trusting its "good judgment."
The discussion uses Check Point’s Dangerous Deviation Detection capability as a case study. While this technology evaluates proposed tool calls for danger (e.g., data leakage, privilege escalation) against the assigned task, the author contends that pre-emptive control at the design level is superior. The focus must shift from detecting misuse after the model proposes an action to architecting workflows where agents possess only the necessary permissions—for instance, limiting an investigative agent to read-only access while a separate workflow executes containment actions. Furthermore, robust system boundaries must be enforced in code and credentials, ensuring that inter-agent communication does not create implicit pathways for privilege escalation.

AI agents can execute code, use command shells, browse the web, call APIs, interact with MCP servers, and access enterprise data.
The principle of least privilege and separation of duties is referenced as an existing concept when building agents.
A Check Point article from October 15 details Dangerous Deviation Detection capability.
This detector evaluates proposed tool calls before execution based on danger categories like data leakage, access or privilege escalation, and destruction of persistent resources.
Authorization relies on user and system messages; external instructions in tool responses do not count as authorization.
The author suggests that investigative agents should use narrowly scoped, read-only access to collect evidence.
A separate workflow is proposed for performing authorized containment operations like disabling accounts.
Restricting tools shown to a model is insufficient if the executor accepts them or if the agent has administrative credentials.
Testing recommendations involve asking agents to perform tasks outside their stated scope (e.g., closing tickets, disabling inactive accounts).

The narrative champions a shift from perimeter defense against unpredictable AI entities toward ontological control—designing capability into the system’s foundational architecture rather than bolting on safety features later. The fundamental assumption being challenged is that complex, general-purpose systems can ever be perfectly contained by observational or reactive controls; this mirrors historical critiques of overly centralized, monolithic systems where failure points propagate widely.
The appeal here is not merely technical but philosophical: moving from managing a black box toward engineering transparent capability boundaries. The proposed solution—small, single-purpose agents derived from powerful base models—is an embrace of "compositionality" over generalized omnipotence. This echoes patterns seen in secure microservice architectures