Ryan Dahl describes Deno's use of agents to investigate production incidents across databases, Kubernetes, GitHub and Slack. That access provides useful context but also exposes destructive operations and prompt-injection paths through support systems. His central principle is to treat the agent as untrusted software and enforce permissions outside its own reasoning or plugins.
Ryan Dahl explains why VM isolation, careful credential provisioning and narrowly scoped MCP tools address only parts of the problem. Subprocesses can communicate through non-HTTP protocols, and access to one service can provide a tunnel to another. The security boundary must therefore understand the network actions an agent actually performs, including database requests reached through intermediate systems.
Ryan Dahl presents Claw Patrol as Deno's external proxy for enforcing protocol-aware rules and injecting credentials without exposing their secret values to the agent. Policies are maintained in a version-controlled HCL file, with protocol extensions for additional systems. He describes a recorded demonstration in which a Codex-spawned PostgreSQL client attempts a destructive action that the proxy rejects.
Ryan Dahl explains that rules can deny actions or route them through human approval, an LLM judge or a sequence of both. A dashboard exposes requests and decisions, while deployment through Tailscale or WireGuard keeps the proxy within controlled network access. Because the proxy holds production credentials, it becomes a sensitive component that requires careful protection.
In the questions, Ryan Dahl describes policy tests that run fixture requests through rules and check expected rejection, alongside tests for the proxy software itself. He argues that improving model alignment may reduce unsafe behavior but does not eliminate the need for independent security controls.
Watch on YouTube
