Tushar Jain frames agent safety as a runtime problem: an agent investigating an incident may legitimately seek logs, code and conversations, yet each new permission expands what can go wrong. A personal example involves an agent unexpectedly publishing a private report as a pull requestData privacy governs how personal, confidential, or sensitive information is collected, used, shared, retained, and protected in AI systems.. Tushar Jain uses these cases to argue that useful autonomy depends on controlling changing access, rather than assuming a sufficiently capable model will always make the right decision.
Tushar Jain proposes three complementary controls. Containment places the agent inside an untrusted environment with enforcement outside the virtual-machine boundary. Scoped capabilities restrict each taskAn agent permission boundary defines and enforces which resources and actions an automated agent is allowed to use. to the information and actions it actually needs, potentially through temporary tools that expose only relevant conversations. Intent-based access then judges a requested capability against the user's goal, denying or escalating actions that do not follow from the task.
Tushar Jain illustrates task separation with a pull-request review followed by a Notion summary. One sandbox receives the access needed to review code; a separate sandbox receives the Notion tool and does not inherit GitHub access. The runtime demonstration also describes credential stubs with real credentials injected outside the agent environmentCredential injection adds authorization to an approved operation at a trusted boundary while keeping the underlying secret outside the agent's view., together with network policies. Several steps are interrupted or replaced with previously prepared examples to fit the talk, so the transcript does not establish a completed result for every demonstration.
Tushar Jain extends the same design to cloud execution, parallel reviews and orchestration. The examples move a sandbox from a local machine to the cloud, launch six isolated review tasks and describe an orchestrator connecting review and publication stagesA multi-agent system contains multiple AI agents that interact, coordinate, divide work, or influence one another while pursuing tasks.. The central architectural claim is that containment and access policy should accompany the work across local machines, clouds and private networks instead of being recreated separately for every environment.
Tushar Jain closes with an internal intent-based access prototype. An agent without GitHub access requests help with a pull request, and the runtime creates a separate sandbox with that capability while keeping the original agent restricted. Tushar Jain contrasts this with an unrelated request embedded in pull-request textPrompt injection occurs when untrusted content attempts to redirect an AI system's behaviour beyond the authority of that content. that should be rejected. The talk explicitly describes intent-based permission decisions as an unresolved problem and the demonstrated approach as prototype work.
Watch on YouTube
