Agent identity by name is untrustworthy: 5 runtime principles for multi-agent credential safety
karc16 · reddit · 2026-10-27
A developer building a runtime guard for autonomous agents shares a hard-won lesson: deciding which credentials an agent run gets based on its name or request tags is untrustworthy, since the agent—or whatever it read—can forge that metadata.
His five principles:
- Naming grants nothing: wire tags are metadata and must never pick credentials
- Owner comes from the OS: use the kernel-reported user ID at launch, never env vars or payload fields
- Operator-written run templates: pin executables by hash, list credential names (never values), cap what the agent can do; security-relevant edits change the template fingerprint
- Fresh instance ID per run: old IDs never return as live authority
- Credentials off by default: nothing is staged without an owner-approved profile
The open problem: the runtime can say "I launched this" but can't yet prove end-to-end "it's the binary I expected"—hash pinning is planned.
More from coding & agent
- nostalgebraist: LLM agents are smart-but-naive first-year grad students, still blundering constantly — JacquesThibs · 2026-10-27
- Apple II Agent revived: a 1980s Apple IIe now writes and runs its own software via Claude — repligate · 2026-10-27
- Writing a 994k-subscriber newsletter with Claude Code: cutting 8 of 10 words to train 74 rules — rubenhassid · 2026-10-27
- How Optiver ships new frontier AI models the same day, with spend control — AI Engineer · 2026-10-27
- shadcn: a voice dictation app is just T3 code plus one prompt — shadcn · 2026-10-27
- Coding got cheap, but the friction we removed was doing useful cognitive work — charles_irl · 2026-10-27