Ryan Dahl describes Deno's use of agents to investigate production incidents across databases, Kubernetes, GitHub and Slack. That access provides useful context but also exposes destructive operations and prompt-injection pathsPrompt injection occurs when untrusted content attempts to redirect an AI system's behaviour beyond the authority of that content. through support systems. His central principle is to treat the agent as untrusted software and enforce permissions outside its own reasoning or pluginsAn agent permission boundary defines and enforces which resources and actions an automated agent is allowed to use..
Ryan Dahl explains why VM isolation, careful credential provisioning and narrowly scoped MCP tools address only parts of the problem. Subprocesses can communicate through non-HTTP protocols, and access to one service can provide a tunnel to another. The security boundary must therefore understand the network actions an agent actually performs, including database requests reached through intermediate systems.
Ryan Dahl presents Claw Patrol as Deno's external proxy for enforcing protocol-aware rulesNetwork security protects communications infrastructure and connected systems from unauthorized access, disruption and misuse. and injecting credentials without exposing their secret valuesCredential injection adds authorization to an approved operation at a trusted boundary while keeping the underlying secret outside the agent's view. to the agent. Policies are maintained in a version-controlled HCL file, with protocol extensions for additional systems. He describes a recorded demonstration in which a Codex-spawned PostgreSQL client attempts a destructive action that the proxy rejects.
Ryan Dahl explains that rules can deny actions or route them through human approvalHuman judgment in AI is the accountable interpretation and decision-making people contribute when setting goals, evaluating evidence, and managing consequences., an LLM judge or a sequence of both. A dashboard exposes requests and decisions, while deployment through Tailscale or WireGuard keeps the proxy within controlled network access. Because the proxy holds production credentials, it becomes a sensitive component that requires careful protection.
In the questions, Ryan Dahl describes policy tests that run fixture requests through rules and check expected rejection, alongside tests for the proxy software itself. He argues that improving model alignment may reduce unsafe behavior but does not eliminate the need for independent security controls.
Watch on YouTube
