DevOps Agents That Can't Delete Your Database
summary
Claims deterministic guardrails stop agents from deleting databases by design: Stakpak is an open-source Rust DevOps agent with secret substitution that replaces secrets with stable IDs, recoverable file operations using udiff-backed reversions, mTLS for MCP, and a transparent proxy called Warden that enforces 30-line Cedar policies as a network sandboxing layer. A recent demo shows Warden blocking a live EC2 “nuke” request; over 100 developers hit ~100% stack customization success while these guardrails prevent destructive cloud API calls.
AI-written summary · about
chapters (7)
- 0:00Introduction to DevOps agents
- 2:32Threat modeling for DevOps agents
- 5:21Preventing secret leaks
- 9:59Protecting configuration files
- 13:11Stopping cloud destruction
- 18:45Live demo of Warden
- 20:30Future of agent security
related talks
27mKeeping Your Agents in Check: Layered Security for Agentic Platforms in Production
39mTrust, but Sandbox: Securing AI Agents in Kubernetes
34mSecure Your Coding Agent Like It’s Malware
30mWhy Prompt-Level Guardrails Fail for AI Agents
43mEmpowering The Guardians Of Your Code Kingdom
39mBuilding Safe AI Agents
17mOur Journey to Safely Unleash Agents at Meta Scale
36mHow to Safely Deploy AI Agents that Write and Manage your IaC