Tushar Jain frames agent safety as a runtime problem: an agent investigating an incident may legitimately seek logs, code and conversations, yet each new permission expands what can go wrong. A personal example involves an agent unexpectedly publishing a private report as a pull request. Tushar Jain uses these cases to argue that useful autonomy depends on controlling changing access, rather than assuming a sufficiently capable model will always make the right decision.
Tushar Jain proposes three complementary controls. Containment places the agent inside an untrusted environment with enforcement outside the virtual-machine boundary. Scoped capabilities restrict each task to the information and actions it actually needs, potentially through temporary tools that expose only relevant conversations. Intent-based access then judges a requested capability against the user's goal, denying or escalating actions that do not follow from the task.
Tushar Jain illustrates task separation with a pull-request review followed by a Notion summary. One sandbox receives the access needed to review code; a separate sandbox receives the Notion tool and does not inherit GitHub access. The runtime demonstration also describes credential stubs with real credentials injected outside the agent environment, together with network policies. Several steps are interrupted or replaced with previously prepared examples to fit the talk, so the transcript does not establish a completed result for every demonstration.
Tushar Jain extends the same design to cloud execution, parallel reviews and orchestration. The examples move a sandbox from a local machine to the cloud, launch six isolated review tasks and describe an orchestrator connecting review and publication stages. The central architectural claim is that containment and access policy should accompany the work across local machines, clouds and private networks instead of being recreated separately for every environment.
Tushar Jain closes with an internal intent-based access prototype. An agent without GitHub access requests help with a pull request, and the runtime creates a separate sandbox with that capability while keeping the original agent restricted. Tushar Jain contrasts this with an unrelated request embedded in pull-request text that should be rejected. The talk explicitly describes intent-based permission decisions as an unresolved problem and the demonstrated approach as prototype work.
Watch on YouTube
