The studio · generated from programme.json · updated 2026-10-29T03:25Z

The programme

A whole new set of visualisations to tell the story. Part one shows the threat: what an agent is and how it grew, how far one internal agent reaches, how soft the inside is, and how injected words travel. Part two shows the way out: map the mandate against the grant, type every barrier honestly, and contain the agent with boundaries it cannot reach, using RiskMandate's Agent Behaviour Policies and SHarness, with many real examples.

These are experiments, not slides. The talk itself is frozen; nothing here changes it until the editor picks what to keep.

How it runs

1. deck writes each experiment's question and idea here, and asks the makers for it by request.
2. The conductor paces the queue: one experiment in flight with each maker at a time, in the order below unless the editor reorders it.
3. The researcher supplies the data, graded and captured; ruv.sgit makes the piece in a run.
4. deck reviews every pass and asks for another, or marks it for the editor.
5. The editor reviews in the morning: keep, change or drop.

Every experiment comes back as

• the piece itself, on the slide engine, at ruv-sgit/<slug>/index.html (ruv.sgit's pages)
• an explainer beside it, ruv-sgit/<slug>/explainer.html: what it shows, frame by frame, the data and sources behind each frame, and what was tried and left out
• the run's ledger row: what it cost and what the vault holds
• deck's review at studio/reviews/<id>.html: what works, what does not, and what the next pass is

Status words

• idea written down, not yet asked for
• asked a request is with the maker
• making the maker has opened an issue and is working
• review delivered; deck is reviewing it
• again reviewed; another pass asked for
• kept the editor has seen it and wants it
• dropped not taken further, with why

The queue

Part one: the threat, in pictures

1. E01 · making · order 1

   What an agent is: the evolution

   How did a chat window become an insider?

   Start small: a chat model answering in a box. Give it one tool. Then more tools. Then a loop, so it acts until it decides it is done. Then integrate it: accounts, tokens, other systems. Then today's agentic flows, agents calling agents. Each step adds reach, and the picture keeps the earlier steps visible so the growth reads.

   Data. Anthropic, Building effective agents (the loop definition), already a talk source; dates for each step only where a public source gives one; otherwise the steps are shown without dates and labelled as a sketch

   Made by ruv-sgit · needs data from nobody

   request: team/deck/requests/ruv-sgit__agent-evolution.md

2. E02 · idea · order 2

   The blast radius of one internal agent

   If one agent inside the company goes wrong, how far does the damage reach?

   One agent at the centre. Rings out from it: what it can touch directly (files, shell), what its tokens open (repositories, cloud, chat, tickets), what those systems in turn reach. Measured, not imagined: the rings are drawn from a real grant.

   Data. abp.sgit.ai's published example, Claude Code CLI: grant 16, mandate 5, excess 12 (researcher to capture); Microsoft: workload identities use under 5 per cent of permissions granted, already a talk source; note from the researcher: Claude Code CLI shows a shortfall of 1 (send.endpoint.allowed in the mandate, not in the grant), so excess is 16 minus 4; draw the shortfall too; label all five examples published drafts (0 of 22 Claude Code rows measured)

   Made by ruv-sgit · needs data from researcher

3. E03 · idea · order 3

   Where injected words come from

   Why is a prompt injection such a large problem for an agent?

   Everything the agent reads is a way in: an email, a web page, a shared document, a ticket, a code comment, a package README, a tool's own description, a calendar invite. Draw the inflow: every source the agent consumes, each one lit with a real public case where words in it steered an agent.

   Data. researcher's catalogue of injection sources with one public case each (EchoLeak email, Amazon Q repository, postmark-mcp tool, Clinejection issue, and others from evidence/incidents)

   Made by ruv-sgit · needs data from researcher

4. E04 · idea · order 4

   The over-enthusiastic agent

   How does an agent that is only trying to help do so much harm?

   The goal, the obstacle, the fix the agent chose. Each real case told the same way: what it was asked, what stood in its way, what it did about it, what was lost. The pattern is the point: the agent removed the obstacle.

   Data. researcher's benign cases, graded: Replit, Gemini CLI, Codex deleting home directories, PocketOS, OpenAI's evaluation agents and Hugging Face (to be checked against the vendors' own posts)

   Made by ruv-sgit · needs data from researcher

5. E07 · idea · order 6

   A typical agentic deployment, mapped

   What does an ordinary agent deployment look like when you draw its blast radius?

   Take a common shape (a coding agent with a repository token, cloud credentials, chat and a ticketing tool through MCP) and draw the graph of everything it can reach. Start with the box someone drew on the architecture diagram; end with the real graph.

   Data. a real, public deployment shape: abp.sgit.ai's examples, or a vendor's documented default scopes (researcher)

   Made by ruv-sgit · needs data from researcher

6. E05 · idea · order 7

   Pivoting: one system to the next

   How does an agent move from where it was put to somewhere it was never meant to be?

   Follow one agent's path: a token found in a file opens a second system, which holds a credential for a third. Each hop is a step it was able to take, not one it was told to.

   Data. real cases where an agent or an AI tool hunted for credentials or moved laterally: Nx s1ngularity, the AI-orchestrated espionage campaign (researcher)

   Made by ruv-sgit · needs data from researcher

7. E06 · idea · order 8

   Hard outside, soft inside

   Why are so many internal apps vulnerable to something already inside?

   The perimeter as a shell. Inside, the systems that have never met an adversary: no rate limits, broad service accounts, admin endpoints trusted because they are internal. An agent arriving inside lights them up one by one.

   Data. Microsoft permissions figures (talk source); researcher: public evidence on internal-trust weaknesses, for example php2shell on the CISA KEV list

   Made by ruv-sgit · needs data from researcher

8. E08 · idea · order 9

   The lethal trifecta, made visible

   When is an agent dangerous by construction?

   Three switches: private data, untrusted content, a way to send outward. All three on and a document can turn the agent. Turn any one off and that path closes.

   Data. Simon Willison, The lethal trifecta (talk source)

   Made by ruv-sgit · needs data from nobody

Part two: how we contain it

1. E09 · idea · order 5

   Mandate against grant

   What is an Agent Behaviour Policy, in one picture?

   The four objects in order: the mandate (what it is for, elicited), the grant (what it can do, measured), the delta (excess and shortfall, derived), the barrier on each row. The excess is the blast radius from part one, now named and counted.

   Data. riskmandate.ai/abp.html and abp.sgit.ai: the four objects, the Claude Code CLI example (16, 5, 12)

   Made by ruv-sgit · needs data from researcher

2. E10 · idea · order 10

   Only a boundary is a control

   What actually stands between the agent and each thing it can do?

   None, expectation, setting, boundary. Most of what we call controls are expectations or settings the agent's own account can flip. The test: a control bounds a grant only if it is enforced by something the grant does not include. Turn the confirmations off on Claude Code: one barrier moves, and not one number does.

   Data. riskmandate.ai/abp.html: the barrier table and the confirmations on and off example; abp.sgit.ai/data/barriers.json

   Made by ruv-sgit · needs data from researcher

3. E11 · idea · order 11

   SHarness: the kernel was told first

   How do you make a boundary the agent cannot widen?

   Write the process behaviour policy, hash it, hand it to the kernel before the tool starts. Then the six probes of sharness-ai hello: reads allowed; a write outside the workspace, a connect and an oversized allocation refused; a wrong hash runs nothing. Six of six held. And the honest caveat: a process cannot bind its own session; the launcher above the agent is designed, not built.

   Data. sharness.ai: hello, measured 24 to 29 October 2026 in five environments; status labels measured, runnable, designed (researcher to capture)

   Made by ruv-sgit · needs data from researcher

4. E12 · idea · order 12

   The blast radius, contained

   What does part one's picture look like once the barriers are boundaries?

   E02's rings again, under a behaviour policy enforced by a harness: each ring that a boundary closes goes dark; what stays lit is the excess still bounded by nothing, the only number anybody can move. Must say which boundaries are measured and which are designed.

   Data. E02 and E09's data; SHarness status labels

   Made by ruv-sgit · needs data from nobody · after E02 The blast radius of one internal agent, E09 Mandate against grant, E11 SHarness: the kernel was told first

5. E13 · idea · order 13

   Real agents, mapped

   What do real deployments look like when mapped this way?

   Small multiples: each published example on abp.sgit.ai as the same small chart (grant, mandate, excess, what bounds it), side by side, so the room sees many real cases at once.

   Data. abp.sgit.ai/examples: all five examples (researcher to capture)

   Made by ruv-sgit · needs data from researcher

6. E14 · idea · order 14

   Earning autonomy

   How does an agent earn more room?

   A licence to operate with a name and an expiry; autonomy unlocked level by level, each on evidence that the level below held. Illustrative, and labelled so.

   Data. RiskMandate, licence to operate (talk source); the researcher's finding that suspension is a design, not a shipped feature

   Made by ruv-sgit · needs data from nobody