Harry Siu | Agent Runtime Governance

Building Yuanhub for agent runtime governance. Real incidents, practical controls: permissions, budgets, approvals and audit trails.

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

Vibe coding makes building an app easier. But what happens after people start using it?

What's the first thing you had to fix after launch — bugs, login issues, permissions, or something you didn't expect? #connect @X

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

Jensen Huang has resigned as NVIDIA's CEO. In 2025, he hand-delivered a DGX Spark to @elonmusk at Starbase.

Could @JensenHuang and @elonmusk team up on something new? If so, what would it be?

[SMX 🇺🇸 @iam_smx]

When Jensen Huang hand-delivered the DGX Spark to Elon Musk, the NVIDIA CEO stayed afterward to watch Starship Flight 11.

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

OpenAI's Daybreak Red Team findings can feed Defense Factory, which prepares patches for engineer review.

Does permission to test also authorize a merge?

Keep test, write and merge permissions separate. Record each approval.

https://t.co/6c5WpKUpVT
https://t.co/sL4bdOUbIl

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

@NimadFlow Agreed. "Sandbox required" should hold for every command, including retries. If that boundary stops holding mid-session, stop the run and surface the failure.

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

Claude Code 2.1.323 fixes -p/SDK runs launching Bash unsandboxed when settings enabling the sandbox fail validation. What happens when a required control can't load? Stop the run. Don't silently drop the control.
https://t.co/DJpP1oeuJx

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

Microsoft's lab study: 90 poisoned training examples made a docs request trigger unsafe calls across different tool interfaces.

Does your deny rule follow the action when the tool changes?

Enforce file and network limits outside the model.

https://t.co/eiNF5Wmoyd

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

@hwchase17 The agent can stay alive after a task ends. That task's permissions shouldn't.

If access is revoked mid-session, is the next tool call blocked, or does the agent keep working until it restarts?

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

Announcement:
https://t.co/q7nIDKYxUP
Deployment boundaries:
https://t.co/seCElAq7cb

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

Anthropic's self-hosted Managed Agents is in private beta. Bash runs with worker permissions; model calls carry conversation data to your chosen provider.

What does self-hosting secure?

Verify session isolation. Minimize tool results sent for inference.

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

@armalo_ai Agreed. I'd test one more path: deny an upload, then try the same file through the shell. The task's data restrictions should hold whichever tool sends it.

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

Darktrace's lab demo used a compromised host and stolen Claude credentials to send commands through shared memory and exfiltrate via the Files API.

Is an approved AI endpoint enough?

Restrict uploads by task and data, not just domain.

https://t.co/7I20pRRCFq

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

@x41ok Agreed—exposed Grafana was the first link recon should catch. If that entry is missed, a compromised dev host still shouldn't inherit cluster-admin authority through an internal tool server.

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

Chainstack reports an internal MCP server required no authentication and ran as cluster-admin. Who is allowed to exercise that authority? Authenticate callers, authorize each operation, and limit the server's Kubernetes permissions. https://t.co/DQtaFKayM8

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

@karimhijazi Agreed. Reaching the MCP server shouldn't mean inheriting its service account's full authority. Each request still needs to be checked against the caller's authorized scope.

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

Hong Kong's AIHK guidelines: keep a central register of material AI agents — identity, owner, permissions, risk tier, approval record. Know your agent before it acts. An agent with no named owner and no approval record is not governed. It's just running.
https://t.co/2f7ZBABRCh

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

https://t.co/QzjgZ3exYK

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

Korea's KISDI has a draft AI agent user-protection guide under external review. Eight areas cover permission scope, approval timing, logs and stop controls. Runtime test: does revocation cancel queued work and stop active work where possible, or only block new calls?

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

@Khaled865412521 Can an issue-triage job write a cache that release jobs restore? That's an indirect path to publish authority, even if triage has no publish token.

I'd separate those cache trust domains and keep release credentials out of issue-driven workflows.

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

@GoogleAIStudio One migration detail worth highlighting: self-hosted environments reject the hosted `network` option.

Where does the egress policy move? Enforce it in your own sandbox infrastructure, then test that a denied destination is still unreachable.

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

Anthropic's policy, effective Nov 12: deployers must ensure agent actions comply, including tool and browser use.

Where can you stop a prohibited action?

My test: deny the tool call, then verify no target-side change occurred.

https://t.co/bvscc9NaJ2

[Harry Siu | Agent Runtime Governance @SiuHarry202601]

VS Code's MCP elicitation fallback could turn server text into a command link. A user click could execute code.

Can the request itself become executable?

Update to 1.145.3+. Render server messages as text, not commands.

https://t.co/cOJGvQkbtU