--- schema: 1 type: video title: 'Security Firewall for Agents — Ryan Dahl, Deno' description: >- Deno gives its incident response agents read and write access to production Postgres, Kubernetes, ClickHouse, AWS, GitHub, and Slack, and it works. Agents now close incidents that used to wake a human up. Ryan Dahl's problem is what happens when one of those agents gets prompt injected through the support system it is wired into. He grants that Opus refuses to drop the users table no matter how hard you push it, then says the part that matters out loud: security cannot be wishful thinking that a model stays obedient. The agent is untrusted software, so the guard cannot live inside it. Claw Patrol is their answer, an MIT licensed proxy that sits in front of the agent and parses every byte leaving it, below the HTTP layer, because the dangerous path frequently is not HTTP. An agent can spawn psql as a subprocess and tunnel to a production database through an EKS endpoint, and no MCP tool definition or HTTP rule will see it. Rules live in HCL, the Terraform configuration language, checked into git and unit tested against fixture requests, with Deno's own file running about a thousand lines. The proxy holds credentials so the agent never sees them, covering cookies, OAuth, and AWS SigV4, and can route an action to an LLM judge, a human in Slack, or both before it is allowed. The demo is Codex in yolo mode cheerfully obeying an order to delete the users table, and the proxy killing it at the Postgres wire protocol. Speaker info: - https://x.com/rough__sea - https://github.com/ry - https://tinyclouds.org/ - https://deno.com Timestamps: 0:00 - Deno Deploy, incidents, and the pager 1:28 - Giving agents write access to production 2:47 - Opus refuses, and why that is not enough 3:28 - Prompt injection through the support system 4:05 - Every action is bytes on the wire 5:24 - The hard case: psql through an EKS endpoint 6:47 - Why credentials and ACLs are not sufficient 7:26 - Where MCP tool permissions break down 8:48 - The existing landscape of proxies and sandboxes 10:09 - Claw Patrol 10:50 - Writing rules in HCL 12:07 - Protocol plugins 12:52 - Demo: blocking a dropped users table 13:34 - The dashboard 14:14 - Approvals by LLM judge or by human 14:58 - Credential injection 15:38 - Running it over Tailscale or WireGuard 16:58 - Agents cannot police themselves 17:42 - Q&A: testing the rule file 18:22 - Q&A: does this get easier as models improve --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/MkRYPFIMCSA-security-firewall-for-agents Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- canonical: 'https://liquidgold.cc/watch/MkRYPFIMCSA' markdown: 'https://liquidgold.cc/watch/MkRYPFIMCSA.md' llms: 'https://liquidgold.cc/watch/MkRYPFIMCSA/llms.txt' parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-24T05:18:58.611Z' language: null children: [] videoId: MkRYPFIMCSA durationSeconds: 1146 publishedAt: '2026-08-17T18:30:06.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 25 endSeconds: 93 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=25' heldReason: rights - ordinal: 1 text: null startSeconds: 25 endSeconds: 93 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=25' heldReason: rights - ordinal: 2 text: null startSeconds: 171 endSeconds: 185 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=171' heldReason: rights - ordinal: 3 text: null startSeconds: 185 endSeconds: 208 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=185' heldReason: rights - ordinal: 4 text: null startSeconds: 219 endSeconds: 253 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=219' heldReason: rights - ordinal: 5 text: null startSeconds: 264 endSeconds: 324 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=264' heldReason: rights - ordinal: 6 text: null startSeconds: 335 endSeconds: 407 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=335' heldReason: rights - ordinal: 7 text: null startSeconds: 407 endSeconds: 417 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=407' heldReason: rights - ordinal: 8 text: null startSeconds: 455 endSeconds: 467 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=455' heldReason: rights - ordinal: 9 text: null startSeconds: 467 endSeconds: 533 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=467' heldReason: rights - ordinal: 10 text: null startSeconds: 533 endSeconds: 544 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=533' heldReason: rights - ordinal: 11 text: null startSeconds: 544 endSeconds: 614 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=544' heldReason: rights - ordinal: 12 text: null startSeconds: 614 endSeconds: 626 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=614' heldReason: rights - ordinal: 13 text: null startSeconds: 650 endSeconds: 660 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=650' heldReason: rights - ordinal: 14 text: null startSeconds: 660 endSeconds: 736 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=660' heldReason: rights - ordinal: 15 text: null startSeconds: 783 endSeconds: 820 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=783' heldReason: rights - ordinal: 16 text: null startSeconds: 854 endSeconds: 866 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=854' heldReason: rights - ordinal: 17 text: null startSeconds: 900 endSeconds: 911 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=900' heldReason: rights - ordinal: 18 text: null startSeconds: 945 endSeconds: 955 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=945' heldReason: rights - ordinal: 19 text: null startSeconds: 1065 endSeconds: 1077 watch: 'https://liquidgold.cc/watch/MkRYPFIMCSA?t=1065' heldReason: rights --- # Security Firewall for Agents — Ryan Dahl, Deno Deno gives its incident response agents read and write access to production Postgres, Kubernetes, ClickHouse, AWS, GitHub, and Slack, and it works. Agents now close incidents that used to wake a human up. Ryan Dahl's problem is what happens when one of those agents gets prompt injected through the support system it is wired into. He grants that Opus refuses to drop the users table no matter how hard you push it, then says the part that matters out loud: security cannot be wishful thinking that a model stays obedient. The agent is untrusted software, so the guard cannot live inside it. Claw Patrol is their answer, an MIT licensed proxy that sits in front of the agent and parses every byte leaving it, below the HTTP layer, because the dangerous path frequently is not HTTP. An agent can spawn psql as a subprocess and tunnel to a production database through an EKS endpoint, and no MCP tool definition or HTTP rule will see it. Rules live in HCL, the Terraform configuration language, checked into git and unit tested against fixture requests, with Deno's own file running about a thousand lines. The proxy holds credentials so the agent never sees them, covering cookies, OAuth, and AWS SigV4, and can route an action to an LLM judge, a human in Slack, or both before it is allowed. The demo is Codex in yolo mode cheerfully obeying an order to delete the users table, and the proxy killing it at the Postgres wire protocol. Speaker info: - https://x.com/rough__sea - https://github.com/ry - https://tinyclouds.org/ - https://deno.com Timestamps: 0:00 - Deno Deploy, incidents, and the pager 1:28 - Giving agents write access to production 2:47 - Opus refuses, and why that is not enough 3:28 - Prompt injection through the support system 4:05 - Every action is bytes on the wire 5:24 - The hard case: psql through an EKS endpoint 6:47 - Why credentials and ACLs are not sufficient 7:26 - Where MCP tool permissions break down 8:48 - The existing landscape of proxies and sandboxes 10:09 - Claw Patrol 10:50 - Writing rules in HCL 12:07 - Protocol plugins 12:52 - Demo: blocking a dropped users table 13:34 - The dashboard 14:14 - Approvals by LLM judge or by human 14:58 - Credential injection 15:38 - Running it over Tailscale or WireGuard 16:58 - Agents cannot police themselves 17:42 - Q\&A: testing the rule file 18:22 - Q\&A: does this get easier as models improve --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/MkRYPFIMCSA-security-firewall-for-agents Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- Canonical: https://liquidgold.cc/watch/MkRYPFIMCSA · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks --- #### Chunk 0: Document excerpt (0:13 to 2:51) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 1: Document excerpt (2:51 to 5:24) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 2: Document excerpt (5:24 to 7:35) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 3: Document excerpt (7:35 to 10:14) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 4: Document excerpt (10:14 to 12:16) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 5: Document excerpt (12:16 to 13:50) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 6: Document excerpt (13:50 to 15:11) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 7: Document excerpt (15:11 to 17:11) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 8: Document excerpt (17:11 to 18:22) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 9: Document excerpt (18:22 to 19:06) > Held: transcript rights do not permit this chunk's text.