Your AI agent is the most over-privileged account you own
AI agents typically receive unrestricted shell access, personal API keys from environment variables, and read access to SSH keys—turning prompt injection into a command channel—so the author's six rules counteract this by scoping agents to task-specific commands like Bash(git *), granting dedicated short-lived service identities, restricting filesystem to one writable workspace, allowlisting egress, gating irreversible actions with human confirmation, and logging all activity for anomaly detection. This applies least privilege principles standard for human accounts to contain agents as potentially compromised deputies.
