What are agents allowed to touch?

“what we were realizing is if there's a person that's deciding yes or no every time, at some point, the person actually just stops reading, and they just say yes, yes, yes, because they're tired of pressing yes. … And our security people were also realizing this. And so … the thing that they started working on is, is there a way to route this to a classifier? So the classifier can decide. … It took many months to kind of get this to a mature state. And in the end, through EVALS, through red teaming, through pen testing, we're able to show that this is actually much safer. And so … at Anthropic, we run on Auto Mode, and we recommend this to all our customers, too.”

Boris ChernyCreator and head of Claude Code, Anthropic · Leader, Anthropic

“We take a stance with the sandboxing that hurts us in terms of general adoption. However, we do not want to promote something that could be unsafe by default. As a dev, you can always go into your configuration and disable these settings if you want.”

Thibault SottiauxHead of Codex · Leader, OpenAI

“How do we dare to do this in a bank? Well, we have the rules built in, and he doesn't have access to the customer data … And then he really tried to get the customer data. He tried to look at the … infrastructure and construct the connection string and all that, but we don't have secrets in our connection strings … managed identity to connect to the database, and his service principal … not have access to the database, so he couldn't get any data.”

Hallstein BrøtanSenior consultant, Novanet; developer on Nordic Corporate Bank's system · Practitioner, Nordic Corporate Bank

“Very simple philosophy. We use our screens. We look at stuff. We do work. Every single thing that a human can see in pixels on the screen, an agent in your building should be able to see via API. The analogy I use is imagine you brought the smartest people ever, the greatest investors alive, and you brought them into your company, but you gave them a computer without logins to 75% of your services. It's almost immaterial how smart … system is if it doesn't have the tools to actually action that.”

Frank LongWorks at Coatue · Practitioner, Coatue

“There is structure: doctrine and policy, human gates, and just fourteen mechanical “fences” (programmatic denials). But my agents are first-class colleagues. They work under my own identity, signing their own names to the work, and they can see the whole system and act independently. It is YOLO mode scaled up to the size of a small company.”

Steve YeggeIndependent; builds and runs Wheelhouse, a solo multi-agent software factory (2026) · Executive, Steve Yegge (independent)

“Again, we are a bank. We live in a regulated environment. So, we want to make sure that the non-determinism from the agents is controlled. But at the same time, we want to have an environment where we can let it run loose and develop.”

Felippe Felisola CasoMonzo (conference affiliation, 2026) · Practitioner, Monzo

“It has access to some production systems with guardrails, you know? So we built, we talked about specialist dots, but specialist dots is just like, operate with additional guardrails, additional monitoring, and then, you know, on their own hardware. So we actually run some on … The fundamental difference in the way that we've built dots is like, the harness does not run on the machine, you know? And then this is like, maybe people have not realized. It's like, it can connect to as many devices as you want. So it has its own computer. You can actually connect it to your own laptop as well. Over time, you might connect it to like, 10 different devices and it can control it all, a little bit like an octopus.”

Thibault SottiauxHead of ChatGPT and Codex, OpenAI · Leader, OpenAI

“Whether a request comes from a user, the automated scheduler, or an agent, the same Schedule Action type is used, including the same validation and commit process.”

DropboxPublished by the organization itself (post), no named author

“The isolation philosophy comes from two things, right? First, we obviously want to reduce the blast radius if a agent goes haywire. That's mainly provided by running these in isolated sandboxes. That can obviously be in Docker or in containers, that can also be on separate EC2 instances. However, you like to manage your isolation.”

Shardul VaidyaSolutions Architect, Data and AI, AWS · Practitioner, Amazon

“We took inspiration from Terraform: agent definitions should live in version control and move through the same review and deployment process as the rest of the product. An agent’s instructions, model, tools, and environment are declared in code, and our deployment pipeline registers changes with Laminar.”

Sam KronickAuthor of Ramp's "Building Laminar" engineering blog post · Practitioner, Ramp

“the key infrastructure for us to spawn a sandboxed container that would run an agent”

MonzoPublished by the organization itself (post), no named author