Access changes the experiment

The NLLabs agent-security note describes work with an agent that encounters public input while retaining private context and access to tools. That combination makes trust boundaries part of the design.

One choice was a dedicated credential vault, separate from personal vaults. Another was to distinguish routine reading from consequential actions, with review and an audit trail at the relevant boundaries.

Three different jobs

Limit exposure

Give the system access to the resources it needs. A smaller credential boundary limits what can be exposed if another control fails.

Authorize actions

Access to a tool is not a standing instruction to do everything it permits. The user’s agreed purpose must survive each handoff.

Keep an account

A useful record connects the request, the action, and the result so a person can reconstruct what happened.

These controls address different failure modes. None establishes that a persistent agent cannot be manipulated.

Memory is part of the boundary

The question I keep coming back to is whether untrusted material can gain authority by being remembered. A quotation or retrieved page can be useful evidence while remaining someone else’s text. Saving it should preserve that distinction.

There is also a practical question about review. Too little review can miss consequential mistakes. Repeated low-value interruptions can make the person stop paying attention. A useful boundary has to fit the action and remain understandable to the person responsible for it.

The public lab account is a single deployment, not a security evaluation. A stronger evaluation would try to cross the boundaries deliberately and measure what the system blocks, misses, and makes visible.

Adapted from the January 2026 NLLabs security note, developed with Clawd. Published here September 5, 2026.

Related: maintaining a commitment and keeping observations distinct from conclusions.