I want to draw deterministic boundaries around what the agent can do. I don't want a probabilistic approach to security.

My view is that if the agent can decide to do something, nothing stops that thing from being done accidentally, and any attacker that can inject text into its context can do that thing.

▲

uw_rob 14 hours ago | parent | next [-]

Deterministic boundaries appear to be best solved with sandboxes/microVMs/remote infra and unique identities with probabilistic guardrails on top. The old deterministic allow/deny list running on bare metal didn't meaningfully solve the problem of giving Claude determinism. Humans got approval fatigue, and eventually, Claude got access to something like 'python3 FILE.py' and Claude could go to the races by updating 'FILE.py'.

▲

canibal 11 hours ago | parent | prev | next [-]

Simple solution, don't use an indeterministic tool to do things that require deterministic constraints?

▲

ImPostingOnHN 9 hours ago | parent [-]

They aren't. Allowlists are a deterministic tool. That's the whole point: instructing an llm to review itself is nondeterministic, and thus not a good tool for permissions, compared to allowlists, which are.

	▲	socalgal2 17 minutes ago \| parent [-]
		In my experience, Allowlists are not deterministic because the #1 thing the LLM does is write python scripts nearly every prompt and ask permission to execute its latest script. I know of no developers who review that code since it would make the process too slow to be useful. So YOLO! Yes, Claude/Codex/Gemini, you can execute the python you just wrote, even though I didn't review it and you have access to the entire machine and so every command I didn't give permission to execute you could just have written the equivalent python.

▲

liveoneggs 3 hours ago | parent | prev [-]

Agentic interaction is not deterministic. That's the entire deal.

	▲	selcuka 2 hours ago \| parent [-]
		Yes, but we are not restricted to agentic interaction only. We can always pass our inputs and outputs through deterministic filters (which is sort of the point of MCP servers and tool calling, for some use cases).