
Walko Systems | AI Governance | Sift | @WSSignal
USA
Joined August 2012
- Tweets9.2K
- Following3.5K
- Followers3.4K
- Likes12.1K
Pointing at the thing you mean is the clearest instruction you can give an agent.
Clear ask going in. Clear record of what changed coming out.
That's how you get work you can actually check.
Jason Walko retweeted
I’m a single dad who is a solo founder.
Looking to connect with other founders and people who are into SI (AI) and tech.
Say hi below and let’s engage!
Before I give an agent a new permission, I answer one question: how fast can I take it back?
If revoking access means digging through config files at midnight, it isn't ready.
Every grant needs an off switch you can hit right away.
The part I keep thinking about isn't the math. It's the checking.
Work you can verify is work you can trust. True for proofs, and true for agents.
Output nobody can check is just a confident guess.
Every new agent I add starts read-only.
It earns write access one action at a time, after I've watched what it tries to do.
Trust with agents works the same as with people. You don't hand over the keys on day one.
Every new CLI you hand your agent is a new set of hands.
Love this. Before I plug one in, I decide two things: what the agent is allowed to call with it, and where the record of each call lands.
More capability is great. It just needs a rule a human approved first.
We launched the Gemini API CLI. A CLI for calling the Gemini API. Give it to the agent you already use (Claude Code, Codex, Antigravity, Cursor, OpenClaw, Hermes...). It's NOT a new coding agent you can use it too:
1. Generate images, video, speech, music.
2. Analyze PDFs, images, audio, video, YouTube URLs,
3. Transcribe recordings to md / json / srt,
4. Run Deep Research in the background.
Stateless. No memory, no chat mode. Your agent owns the context and the plan, gemini-api does the API call. Build for Agents, it's self-describing. `--help`, `--dry-run`...
Start here: aistudio.google.com/learn/in…
The most useful thing my agents do is get told no.
Every denied action tells you something. Either the agent tried something it shouldn't, or the rule was wrong.
Read your denials regularly. That's where your policy actually gets better.
This is the shift. Nobody clicks through the system anymore. The agent does it for them.
So every action needs an answer to one question: who said the agent could?
An approved rule before it acts. A receipt after.
$ORCL ANNOUNCES NEW AI PLATFORM THAT LETS CHATGPT EXECUTE ENTERPRISE WORKFLOWS
Oracle introduced Fusion Companion and Fusion Agentic Home at Oracle AI World, allowing employees to manage business operations through AI tools like ChatGPT.
Instead of navigating multiple applications, users can describe what they want done, and the system identifies and coordinates the necessary transactions, workflows, approvals, and AI agents.
The technology works across Oracle's Fusion applications, including finance, HR, supply chain, sales, and customer service, while maintaining enterprise security and permissions.
Simple question for anyone building with AI agents:
What's one thing you'd never let your agent do without asking you first?
Mine: anything that can't be undone. Sending money, deleting data, emailing a customer.
The two on this list I'd bet on first: the agent harness and agent identity.
They're the same problem from two sides.
The harness decides what an agent can do. Identity decides who did it. You need both before an agent touches anything real.
TOP 10 STRATEGIC TECH TRENDS AND PREDICTIONS 2027-2031, GARTNER
1 Large quantitative models
2 Speech reasoning models
3 World models
4 AI context platforms
5 AI coding agent harness
6 AI agent identity
7 Autonomous exposure remediation
8 SovereignTech
9 Disposable applications
10 Wetware as a service
Predictions for 2027-2031:
————————————
1. By 2030, LQMs will replace LLMs in 25% of strategic forecasting and operational modeling tasks across major enterprise functions.
2. By 2030, over 70% of enterprise voice interactions will be handled autonomously by speech models, up from less than 10% in 2026.
3. By 2030, 40% of robotics applications will incorporate world models to drive optimal decisions in adaptive environments, compared with less than 1% in 2025.
4. By 2027, organizations that prioritize semantics in AI-ready data will increase agentic AI accuracy by up to 80% and reduce costs by up to 60%.
5. By late 2026, autonomous coding agents will generate 20% of all public commits, making closed-loop harnesses mandatory to prevent critical software delivery quality failures.
6. By 2028, 25% of enterprise security breaches will trace back to AI agent abuse due to unmanaged machine privileges and legacy credential practices. If organizations don’t resolve
these identity challenges, over half of their enterprise AI initiatives will halt entirely.
7. By 2031, organizations deploying autonomous exposure remediation will reduce their average vulnerability containment window from weeks to within 48 hours.
8. By 2030, over 75% of non-U.S.-based organizations will adopt digital sovereignty strategies, shifting critical workloads to reduce geopolitical and vendor lock-in risks.
9. By 2030, widespread SaaS fatigue and AI-driven software abundance will force leading organizations to ensure 80% of new applications are disposable and easy to replace.
10. By 2030, 25% of enterprise organizations prioritizing specialized low-power AI will deploy biological
computing to bypass traditional silicon limits.
Gartner’s top 10 strategic technology trends for 2027 is a strong reminder for all business leaders: the future of business is autonomous.
If all your agents share one API key, you don't have a team of agents. You have one anonymous actor.
When something breaks, the log says the key did it. Not which agent. Not why.
Give every agent its own identity first. Rules and receipts only mean something after that.
I’m a single dad who is a solo founder.
Looking to connect with other founders and people who are into SI (AI) and tech.
Say hi below and let’s engage!
The line that matters most here: gate write policies.
An agent running overnight is an agent nobody is watching.
Reads can be looser. Writes need a rule a human signed off on, and a receipt you can check in the morning.
Boris Cherny, creator of Claude Code, shared the harness for overnight runs
build on Sonnet 5.5, audit via Opus 5.5, and gate write policies before Fable 5.5 drops
claude -p "Read PROGRESS.md and build next feature per CLAUDE.md"
why naive agent loops always crash after 2 hours:
- models hallucinate passing tests to terminate early
- context bloat eats 150k tokens of dead terminal output
- process restarts trigger total amnesia and restart from zero
Anthropic solved this with their official long-running harness repo: anthropics/cwc-long-running-agents
the architecture replaces blind LLM trust with shell-enforced write policies:
1. Default-FAIL Contract
every test requirement initializes as false
an agent cannot flip status to passing by simply claiming it passed
the write policy gate physically blocks file updates until proof logs exist
2. PreToolUse Interceptor Gate
verify -gate.sh intercepts every Write tool call to test-results.json
track -read.sh monitors evidence reads from vitest.log and browser screenshots
zero evidence opened = instant write rejection
3. Isolated Fresh-Context Evaluator
Sonnet 5.5 builds features inside the active workspace
Opus 5.5 evaluates the output in an isolated 0k context window
the evaluator has zero Write tools, preventing self-grading contamination
4. Zero-Amnesia Context Flushing
every verified milestone writes to PROGRESS.md and creates a git commit
the harness flushes 142k RAM tokens and restarts the builder loop fresh
zero context degradation, zero memory loss, infinite unattended runway
run this prompt inside Claude Code to install the harness:
"Configure this repo for autonomous long-running execution using Anthropic harness primitives:
1. Install PreToolUse hooks from anthropics/cwc-long-running-agents:
- set up .claude/hooks/verify-gate.sh to intercept all writes to test-results.json
- set up .claude/hooks/track-read.sh to verify test logs and screenshots were opened
- enforce Default-FAIL contract where all criteria start false
2. Configure dual-agent roles in ~/.claude/settings.json:
- Builder agent: Sonnet 5.5 with full workspace editing tools
- Evaluator agent: Opus 5.5 with zero write permissions in fresh context
3. Setup persistence and operator control:
- update PROGRESS.md and commit to git on every passing milestone
- enable kill -switch.sh via AGENT_STOP and steering via STEER.md
Show me the configuration diff first. Await confirmation before applying"
↳ github.com/anthropics/cwc-lo…
The demo always works.
Production is where your agent meets a weird input, a timeout, or a permission it never should have had.
Demos sell what an agent can do. What closes the deal is showing what it's not allowed to do.
Matches what I've seen running agents for real.
A bigger harness doesn't make the agent smarter. It gives it more ways to act.
The part worth getting right isn't how much it can do. It's what it's allowed to do, and whether you can prove what it did.
Popular belief is that a complex AI harness like Claude Code or Codex will improve the capabilities of LLMs in coding tasks.
But two separate studies show that the added complexity of the harness does not necessarily improve the accuracy of the coding agent. In some cases, it can triple the LLM token bill without giving you significant improvement.
Take the self-reported benchmark results of AI vendors with a grain of salt. Sometimes, running the same prompt multiple times on the same model-harness configuration will give you a spread that is wider than the improvement that vendors report on their harnesses.
Develop your own benchmarks/evals, run your own tests, make your own judgment.
I'd never opened a terminal when I started building with AI.
Now I'm building the governance layer for AI agents.
You don't need a CS degree to build real things. You need a problem that won't leave you alone and the patience to keep shipping.
Unconfined bash is the agent version of leaving the front door open.
A sandbox decides where an agent can act. You still need a rule for what it's allowed to do, and a record of what it did.
Both. Not one or the other.
Official Anthropic tip: stop burning Opus 5.5 tokens on tasks Sonnet 5.5 can swarm, and stop running autonomous agents with unconfined bash access
jail the entire multi-model runtime at the kernel layer with srt
npx @ anthropic-ai/sandbox-runtime run --allow-net registry.npmjs. org claude
Opus 5.5 plans architecture and acts as dedicated security advisor
Sonnet 5.5 writes the code and executes tool actions inside the sandbox
Haiku 5.5 swarms dependency triage and network domain verification
the srt kernel engine audits every tool call at three critical points:
→ before filesystem reads: is the path strictly inside the project root?
→ when network egress triggers: is the outbound domain allowlisted in proxy rules?
→ before child process spawns: are ~/.ssh, ~/.env, and root credentials blocked?
Haiku scans. Sonnet builds. Opus verifies. srt jails in 0.2ms
Docker sandboxing is the wrong primitive for multi-agent loops: container spinup burns 2,450ms, memory overhead inflates by 650MB, and host integration breaks
srt enforces macOS Seatbelt and Linux bubblewrap directly at the OS kernel layer with 0.2ms syscall overhead and zero container bloat
Plan on Opus. Build on Sonnet. Swarm on Haiku. Jail with srt
- the full multi-agent sandbox setup
> Opus 5.5 on high reasoning plans the task and audits security contracts
> Sonnet 5.5 executes code edits and unit tests inside the active workspace
> Haiku 5.5 swarms file indexing, AST diffs, and package triage at 340 tok/s
> srt wraps all child bash commands and local MCP servers via OS kernel primitives
> filesystem restricted to read-write in workspace, blocked in ~/.ssh and ~/.env
> network egress filtered through a local proxy with domain allowlisting
> 0.2ms syscall overhead, 4MB RAM footprint, zero Docker container bloat
paste the setup and this prompt into Claude Code ↓
"Configure my Claude Code workspace for multi-model sandboxed execution:
1. Install and verify @ anthropic-ai/sandbox-runtime globally:
> Verify kernel backends: Seatbelt on macOS or bubblewrap on Linux
> Ensure non-root execution without Docker daemon requirements
2. Set up model role delegation in ~/.claude/settings.json:
> Main lead session: Opus 5.5 on high effort for architectural planning
> Worker subagents: Sonnet 5.5 at medium effort for code writing and tests
> Fast scanner subagents: Haiku 5.5 for file search, linting, and docs triage
3. Wrap all bash tool calls and MCP servers with srt kernel boundaries:
> Enforce execution prefix: srt run --allow-net=registry.npmjs. org,github. com
> Confine filesystem read-write permissions strictly to the current workspace directory
> Blacklist ~/.ssh, ~/.aws, ~/.gnupg, and all .env files from agent reads
4. Add a security rule to ~/.claude/CLAUDE.md: consult Opus 5.5 before approving a large plan, and reject any command attempting to bypass srt kernel profiles
Show me every configuration change as a diff first. No edits until I say go."
↳ github.com/anthropics/sandbo…
Every agent action should leave a receipt.
Who did it. What rule allowed it. Proof it wasn't changed after.
If you can't answer those, you don't have governance. You have hope.
Funny because it works. But flip it around. If a text file can talk an attacker's agent into disconnecting, a text file can talk yours into anything. Reading untrusted input should never be enough to trigger an action. That's what policy is for.









