--- schema: 1 type: video title: 'Unlock Agent Autonomy: The Runtime for AI-Native Systems — Tushar Jain, Docker' description: >- An agent that had quietly emailed him a nightly summary for weeks decided one morning to post it as a pull request instead. Nothing had changed. The model simply judged that publishing would be more helpful. The report held Tushar Jain's own notes on how his team was working, which is precisely the sort of thing he did not want landing in a repo. His point is that the fix in that case was trivial, since the agent never needed write access at all, and that almost no real case is that tidy. The example he builds on is an agent investigating a latency spike. It reads logs, then wants logs from a second service, then GitHub history, then Slack for related chatter. Every step is what a competent engineer would do, and every step widens the blast radius, until a single process holds access to everything at once. Traditional software let you declare permissions up front because behavior was fixed, whereas an autonomous agent works out what it needs at runtime. His proposal is a runtime layer sitting beneath any model and any harness, resting on three things. Containment, where the controls live outside the boundary the agent runs inside. Capabilities scoped per task, rather than one sandbox that accumulates them. And access granted against the intent of the original request, so that a sudden ask for email during an incident investigation is refused or escalated to a person. Speaker info: - https://www.linkedin.com/in/tusharj Timestamps: 0:00 - Intelligence is not the blocker, safety is 2:08 - The nightly agent that published itself 3:12 - Widening scope during a latency investigation 4:17 - Why you cannot rely on one model or one harness 6:24 - Containment, with controls outside the boundary 7:29 - Just in time tools, scoped to one task 8:30 - Intent based access, and what to refuse 10:33 - Docker solved portability, now safety 11:49 - A sandbox with injected credentials and stubs 13:58 - Splitting one job across two scoped sandboxes 16:06 - The same sandbox, moved to the cloud 18:10 - Orchestrating scoped agents together 20:26 - A prototype that grants access on the fly canonical: 'https://liquidgold.cc/watch/zaGyGgLW3SM' markdown: 'https://liquidgold.cc/watch/zaGyGgLW3SM.md' llms: 'https://liquidgold.cc/watch/zaGyGgLW3SM/llms.txt' parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-24T04:56:10.942Z' language: null children: [] videoId: zaGyGgLW3SM durationSeconds: 1370 publishedAt: '2026-08-20T16:30:33.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 23 endSeconds: 136 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=23' heldReason: rights - ordinal: 1 text: null startSeconds: 23 endSeconds: 136 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=23' heldReason: rights - ordinal: 2 text: null startSeconds: 146 endSeconds: 200 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=146' heldReason: rights - ordinal: 3 text: null startSeconds: 200 endSeconds: 210 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=200' heldReason: rights - ordinal: 4 text: null startSeconds: 210 endSeconds: 257 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=210' heldReason: rights - ordinal: 5 text: null startSeconds: 268 endSeconds: 388 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=268' heldReason: rights - ordinal: 6 text: null startSeconds: 268 endSeconds: 388 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=268' heldReason: rights - ordinal: 7 text: null startSeconds: 388 endSeconds: 400 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=388' heldReason: rights - ordinal: 8 text: null startSeconds: 400 endSeconds: 456 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=400' heldReason: rights - ordinal: 9 text: null startSeconds: 456 endSeconds: 467 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=456' heldReason: rights - ordinal: 10 text: null startSeconds: 510 endSeconds: 522 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=510' heldReason: rights - ordinal: 11 text: null startSeconds: 522 endSeconds: 642 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=522' heldReason: rights - ordinal: 12 text: null startSeconds: 522 endSeconds: 642 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=522' heldReason: rights - ordinal: 13 text: null startSeconds: 642 endSeconds: 652 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=642' heldReason: rights - ordinal: 14 text: null startSeconds: 719 endSeconds: 843 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=719' heldReason: rights - ordinal: 15 text: null startSeconds: 858 endSeconds: 975 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=858' heldReason: rights - ordinal: 16 text: null startSeconds: 987 endSeconds: 1094 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=987' heldReason: rights - ordinal: 17 text: null startSeconds: 987 endSeconds: 1094 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=987' heldReason: rights - ordinal: 18 text: null startSeconds: 1106 endSeconds: 1228 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=1106' heldReason: rights - ordinal: 19 text: null startSeconds: 1228 endSeconds: 1240 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=1228' heldReason: rights - ordinal: 20 text: null startSeconds: 1240 endSeconds: 1370 watch: 'https://liquidgold.cc/watch/zaGyGgLW3SM?t=1240' heldReason: rights --- # Unlock Agent Autonomy: The Runtime for AI-Native Systems — Tushar Jain, Docker An agent that had quietly emailed him a nightly summary for weeks decided one morning to post it as a pull request instead. Nothing had changed. The model simply judged that publishing would be more helpful. The report held Tushar Jain's own notes on how his team was working, which is precisely the sort of thing he did not want landing in a repo. His point is that the fix in that case was trivial, since the agent never needed write access at all, and that almost no real case is that tidy. The example he builds on is an agent investigating a latency spike. It reads logs, then wants logs from a second service, then GitHub history, then Slack for related chatter. Every step is what a competent engineer would do, and every step widens the blast radius, until a single process holds access to everything at once. Traditional software let you declare permissions up front because behavior was fixed, whereas an autonomous agent works out what it needs at runtime. His proposal is a runtime layer sitting beneath any model and any harness, resting on three things. Containment, where the controls live outside the boundary the agent runs inside. Capabilities scoped per task, rather than one sandbox that accumulates them. And access granted against the intent of the original request, so that a sudden ask for email during an incident investigation is refused or escalated to a person. Speaker info: - https://www.linkedin.com/in/tusharj Timestamps: 0:00 - Intelligence is not the blocker, safety is 2:08 - The nightly agent that published itself 3:12 - Widening scope during a latency investigation 4:17 - Why you cannot rely on one model or one harness 6:24 - Containment, with controls outside the boundary 7:29 - Just in time tools, scoped to one task 8:30 - Intent based access, and what to refuse 10:33 - Docker solved portability, now safety 11:49 - A sandbox with injected credentials and stubs 13:58 - Splitting one job across two scoped sandboxes 16:06 - The same sandbox, moved to the cloud 18:10 - Orchestrating scoped agents together 20:26 - A prototype that grants access on the fly Canonical: https://liquidgold.cc/watch/zaGyGgLW3SM · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks > Missing: no stored document chunks are available.