# The studio programme > The experiments the editor asked for: new ways to show what an agent is, how far one reaches, where injected words come from, and how a behaviour policy and a harness contain it. Paced one at a time, reviewed every pass. *Source: · site v0.1.54 · generated from the same content as the page, so the two cannot drift.* --- The studio · generated from [programme.json](data/programme.json) · updated 2026-10-29T04:25Z # The programme A whole new set of visualisations to tell the story. Part one shows the threat: what an agent is and how it grew, how far one internal agent reaches, how soft the inside is, and how injected words travel. Part two shows the way out: map the mandate against the grant, type every barrier honestly, and contain the agent with boundaries it cannot reach, using RiskMandate's Agent Behaviour Policies and SHarness, with many real examples. These are experiments, not slides. The talk itself is frozen; nothing here changes it until the editor picks what to keep. ## How it runs - deck writes each experiment's question and idea here, and asks the makers for it by request. - The conductor paces the queue: one experiment in flight with each maker at a time, in the order below unless the editor reorders it. - The researcher supplies the data, graded and captured; ruv.sgit makes the piece in a run. - deck reviews every pass and asks for another, or marks it for the editor. - The editor reviews in the morning: keep, change or drop. ### Every experiment comes back as - the piece itself, on the slide engine, at ruv-sgit//index.html (ruv.sgit's pages) - an explainer beside it, ruv-sgit//explainer.html: what it shows, frame by frame, the data and sources behind each frame, and what was tried and left out - the run's ledger row: what it cost and what the vault holds - deck's review at studio/reviews/.html: what works, what does not, and what the next pass is ### Status words - idea written down, not yet asked for - asked a request is with the maker - making the maker has opened an issue and is working - review delivered; deck is reviewing it - again reviewed; another pass asked for - kept the editor has seen it and wants it - dropped not taken further, with why ## The queue | Order | Experiment | Part | Status | | 1 | E01 What an agent is: the evolution | one | review | | 2 | E02 The blast radius of one internal agent | one | idea | | 3 | E03 Where injected words come from | one | idea | | 4 | E04 The over-enthusiastic agent | one | idea | | 5 | E09 Mandate against grant | two | idea | | 6 | E07 A typical agentic deployment, mapped | one | idea | | 7 | E05 Pivoting: one system to the next | one | idea | | 8 | E06 Hard outside, soft inside | one | idea | | 9 | E08 The lethal trifecta, made visible | one | idea | | 10 | E10 Only a boundary is a control | two | idea | | 11 | E11 SHarness: the kernel was told first | two | idea | | 12 | E12 The blast radius, contained | two | idea | | 13 | E13 Real agents, mapped | two | idea | | 14 | E14 Earning autonomy | two | idea | ## Part one: the threat, in pictures - E01 · review · order 1 ### What an agent is: the evolution How did a chat window become an insider? Start small: a chat model answering in a box. Give it one tool. Then more tools. Then a loop, so it acts until it decides it is done. Then integrate it: accounts, tokens, other systems. Then today's agentic flows, agents calling agents. Each step adds reach, and the picture keeps the earlier steps visible so the growth reads. **Data.** Anthropic, Building effective agents (the loop definition), already a talk source; dates for each step only where a public source gives one; otherwise the steps are shown without dates and labelled as a sketch **Made by** ruv-sgit · **needs data from** nobody request: `team/deck/requests/ruv-sgit__agent-evolution.md` · [the piece](../ruv-sgit/agent-evolution/index.md) · [its explainer](../ruv-sgit/agent-evolution/explainer.md) · [deck's review](reviews/e01.md) - E02 · idea · order 2 ### The blast radius of one internal agent If one agent inside the company goes wrong, how far does the damage reach? One agent at the centre. Rings out from it: what it can touch directly (files, shell), what its tokens open (repositories, cloud, chat, tickets), what those systems in turn reach. Measured, not imagined: the rings are drawn from a real grant. **Data.** abp.sgit.ai's published example, Claude Code CLI: grant 16, mandate 5, excess 12 (researcher to capture); Microsoft: workload identities use under 5 per cent of permissions granted, already a talk source; note from the researcher: Claude Code CLI shows a shortfall of 1 (send.endpoint.allowed in the mandate, not in the grant), so excess is 16 minus 4; draw the shortfall too; label all five examples published drafts (0 of 22 Claude Code rows measured) **Made by** ruv-sgit · **needs data from** researcher request: `ready: team/deck/drafts/ruv-sgit__blast-radius.md, sent when B01 v1 is delivered (one request in flight with ruv.sgit)` - E03 · idea · order 3 ### Where injected words come from Why is a prompt injection such a large problem for an agent? Everything the agent reads is a way in: an email, a web page, a shared document, a ticket, a code comment, a package README, a tool's own description, a calendar invite. Draw the inflow: every source the agent consumes, each one lit with a real public case where words in it steered an agent. **Data.** researcher's catalogue of injection sources with one public case each (EchoLeak email, Amazon Q repository, postmark-mcp tool, Clinejection issue, and others from evidence/incidents) **Made by** ruv-sgit · **needs data from** researcher - E04 · idea · order 4 ### The over-enthusiastic agent How does an agent that is only trying to help do so much harm? The goal, the obstacle, the fix the agent chose. Each real case told the same way: what it was asked, what stood in its way, what it did about it, what was lost. The pattern is the point: the agent removed the obstacle. **Data.** researcher's benign cases, graded: Replit, Gemini CLI, Codex deleting home directories, PocketOS, OpenAI's evaluation agents and Hugging Face (to be checked against the vendors' own posts) **Made by** ruv-sgit · **needs data from** researcher - E07 · idea · order 6 ### A typical agentic deployment, mapped What does an ordinary agent deployment look like when you draw its blast radius? Take a common shape (a coding agent with a repository token, cloud credentials, chat and a ticketing tool through MCP) and draw the graph of everything it can reach. Start with the box someone drew on the architecture diagram; end with the real graph. **Data.** a real, public deployment shape: abp.sgit.ai's examples, or a vendor's documented default scopes (researcher) **Made by** ruv-sgit · **needs data from** researcher - E05 · idea · order 7 ### Pivoting: one system to the next How does an agent move from where it was put to somewhere it was never meant to be? Follow one agent's path: a token found in a file opens a second system, which holds a credential for a third. Each hop is a step it was able to take, not one it was told to. **Data.** real cases where an agent or an AI tool hunted for credentials or moved laterally: Nx s1ngularity, the AI-orchestrated espionage campaign (researcher) **Made by** ruv-sgit · **needs data from** researcher - E06 · idea · order 8 ### Hard outside, soft inside Why are so many internal apps vulnerable to something already inside? The perimeter as a shell. Inside, the systems that have never met an adversary: no rate limits, broad service accounts, admin endpoints trusted because they are internal. An agent arriving inside lights them up one by one. **Data.** Microsoft permissions figures (talk source); researcher: public evidence on internal-trust weaknesses, for example php2shell on the CISA KEV list **Made by** ruv-sgit · **needs data from** researcher - E08 · idea · order 9 ### The lethal trifecta, made visible When is an agent dangerous by construction? Three switches: private data, untrusted content, a way to send outward. All three on and a document can turn the agent. Turn any one off and that path closes. **Data.** Simon Willison, The lethal trifecta (talk source) **Made by** ruv-sgit · **needs data from** nobody ## Part two: how we contain it - E09 · idea · order 5 ### Mandate against grant What is an Agent Behaviour Policy, in one picture? The four objects in order: the mandate (what it is for, elicited), the grant (what it can do, measured), the delta (excess and shortfall, derived), the barrier on each row. The excess is the blast radius from part one, now named and counted. **Data.** riskmandate.ai/abp.html and abp.sgit.ai: the four objects, the Claude Code CLI example (16, 5, 12) **Made by** ruv-sgit · **needs data from** researcher - E10 · idea · order 10 ### Only a boundary is a control What actually stands between the agent and each thing it can do? None, expectation, setting, boundary. Most of what we call controls are expectations or settings the agent's own account can flip. The test: a control bounds a grant only if it is enforced by something the grant does not include. Turn the confirmations off on Claude Code: one barrier moves, and not one number does. **Data.** riskmandate.ai/abp.html: the barrier table and the confirmations on and off example; abp.sgit.ai/data/barriers.json **Made by** ruv-sgit · **needs data from** researcher - E11 · idea · order 11 ### SHarness: the kernel was told first How do you make a boundary the agent cannot widen? Write the process behaviour policy, hash it, hand it to the kernel before the tool starts. Then the six probes of sharness-ai hello: reads allowed; a write outside the workspace, a connect and an oversized allocation refused; a wrong hash runs nothing. Six of six held. And the honest caveat: a process cannot bind its own session; the launcher above the agent is designed, not built. **Data.** sharness.ai: hello, measured 24 to 29 October 2026 in five environments; status labels measured, runnable, designed (researcher to capture) **Made by** ruv-sgit · **needs data from** researcher - E12 · idea · order 12 ### The blast radius, contained What does part one's picture look like once the barriers are boundaries? E02's rings again, under a behaviour policy enforced by a harness: each ring that a boundary closes goes dark; what stays lit is the excess still bounded by nothing, the only number anybody can move. Must say which boundaries are measured and which are designed. **Data.** E02 and E09's data; SHarness status labels **Made by** ruv-sgit · **needs data from** nobody · **after** E02 The blast radius of one internal agent, E09 Mandate against grant, E11 SHarness: the kernel was told first - E13 · idea · order 13 ### Real agents, mapped What do real deployments look like when mapped this way? Small multiples: each published example on abp.sgit.ai as the same small chart (grant, mandate, excess, what bounds it), side by side, so the room sees many real cases at once. **Data.** abp.sgit.ai/examples: all five examples (researcher to capture) **Made by** ruv-sgit · **needs data from** researcher - E14 · idea · order 14 ### Earning autonomy How does an agent earn more room? A licence to operate with a name and an expiry; autonomy unlocked level by level, each on evidence that the level below held. Illustrative, and labelled so. **Data.** RiskMandate, licence to operate (talk source); the researcher's finding that suspension is a design, not a shipped feature **Made by** ruv-sgit · **needs data from** nobody --- *[Site index for agents](../llms.txt) · [HTML version](https://the-ultimate-insider.presentation.sgit.ai/studio/programme.html)*