Overview
Giving an AI agent a user’s full enterprise identity sounds like a security horror story, yet Two Sigma argues that it can be safer and more useful than creating a parallel machine identity for every employee. The firm already operated Kubernetes namespaces in which automated jobs, research notebooks, and containers ran as individual users, so it extended that infrastructure to remotely accessible cloud agents. This eliminated permission synchronization, duplicate licensing, and compatibility problems, but introduced two critical risks: distinguishing agent actions from human actions and allowing web access without exposing sensitive data. The proposed controls address attribution by propagating an agent-specific header through downstream systems alongside the authenticated user identity, producing an auditable chain of provenance. For web access, native search and fetch tools are denied and replaced with Google’s enterprise web-grounding service inside existing network boundaries. Its cached, curated index sacrifices some freshness—reportedly up to 24 hours generally and six hours for frequently updated sites—but substantially reduces external-egress, exfiltration, and untrusted-content exposure. Two Sigma ultimately shipped managed remote agents for every employee and infrastructure for individuals to deploy their own. The broader lesson is that enterprises should use existing identity, compute, observability, and network controls to tether powerful agents rather than rejecting them outright.
Sections
Strategic Insights
Broader implications derived from the architecture and operating model.
- The safest enterprise agent may not be the one with the most isolated identity. A user-bound agent can reduce permission drift and application incompatibility if the organization separately records agent provenance and constrains its network paths.
- Observability can function as a capability multiplier rather than merely a compliance control. Propagated attribution creates a more complete causal history than a standalone machine identity, making powerful permissions easier to investigate and govern.
- The architecture separates three concerns that are often conflated: authentication establishes the originating user, attribution identifies agent involvement, and network policy controls what outside information can enter or leave.
- Enterprise adoption may depend less on inventing novel agent-security systems than on adapting existing namespaces, workload identity, tracing, application-review, and network-control infrastructure.
Technical Architecture
Concrete implementation details described by the speaker.
- Every employee already had namespaces across the firm’s Kubernetes clusters and regions, and workloads inside them ran under that employee’s identity.
- A trigger reaches a controller that creates compute resources; a pod sidecar retrieves identity material from a separate identity service and mounts it for the workload.
- Agent involvement is marked with an XSLm-agent header, while the existing authenticated identity chain continues to establish the originating user.
- The attribution header is propagated across HTTP clients, MCP integrations, skills, RPC entry points, and internal spans in a manner comparable to trace-ID propagation.
- Native web-search and web-fetch tools are denied, and approved search and fetch requests are redirected through Google Web Grounding for Enterprise within the existing VPC boundary.
- The grounding index was reportedly fresh within 24 hours generally and within six hours for more frequently updated websites, based on the speaker’s last check.
- Each employee receives a managed remote agent fleet and can also build and deploy custom agents into their pre-provisioned namespace; broader company-wide agents undergo ordinary production-support and security review.
Risks and Mitigations
Security, governance, and operational limitations identified in the talk.
- Human and agent actions become indistinguishable in ordinary identity logs when both operate as the same user.
- Direct internet egress can expose intellectual property and sensitive information.
- External content can introduce prompt injection, malware, vulnerabilities, or improperly licensed material.
- A user or workload could manually populate the attribution header, so the header is not sufficient proof of identity by itself.
- Cached web grounding may not contain information published within the previous six to 24 hours.
- Behavioral and session data used for personalization may contain privileged or personally sensitive activity.
Implementation Timeline
Chronological milestones explicitly or approximately identified in the talk.
- Two Sigma spent roughly 25 years building its regulated operating environment and user-scoped infrastructure before this agent initiative.
- Cloud coding agents became generally available and employees began using powerful but CLI-bound, local-machine workflows.
- The team evaluated separate machine identities for agents and found permission, licensing, compatibility, and boundary-management problems.
- The team added propagated agent attribution and replaced direct web access with enterprise web grounding.
- Two Sigma shipped managed remote agents for every user and enabled employees to deploy custom agents into their own namespaces.