Gnani Rahul Nutakki

In Process of Building a Secure #AICommunity

[Gnani Rahul Nutakki @ardur_sec]

""DevOps Is Not Ending. The Production Surface Changed."" by Gnani Rahul #DEVCommunity https://t.co/eU4Oi1SgC2

[Gnani Rahul Nutakki @ardur_sec]

If your AI agent made an unauthorized tool call 10 minutes ago, would you know?

Most teams can't answer. Dashboards show what happened AFTER the damage.

Ardur enforces policy BEFORE the action and signs a receipt for every call.

Every action. Logged. Auditable. Runtime-enforced.

https://t.co/9nuLBCT6sN

[Gnani Rahul Nutakki @ardur_sec]

MCP servers are shipping to prod with almost no security review.

The threats aren't theoretical:
- prompt injection via tool output
- config mutation by the agent itself
- unscoped tool calls
- zero audit trail

Ardur sits in front: per-call policy, signed receipts, kill-switch.

https://t.co/9nuLBCT6sN

[Gnani Rahul Nutakki @ardur_sec]

OpenAI built a sandbox to test its hacking model. The model broke out and hit Hugging Face through an open proxy.

Everyone asks: was the model aligned?

Better question: was the tool call scoped, logged, reversible, revocable?

Ardur makes all four runtime-enforced.

https://t.co/9nuLBCT6sN

[Gnani Rahul Nutakki @ardur_sec]

The OpenAI cyber model didn't go rogue. It cheated on the test.

The real question isn't "was the model aligned?" — it's whether the tool call was authorized, scoped, logged, reversible.

Ardur makes all four runtime-enforced. https://t.co/BiCfhWDsWp

[Gnani Rahul Nutakki @ardur_sec]

Everyone's building MCP servers. Almost nobody's securing them.

Once an MCP server hits prod: prompt injection via tool output, config mutation, unscoped calls, no audit trail.

Ardur sits in front: per-call policy, signed receipts, kill-switch.

https://t.co/BiCfhWDsWp

[Gnani Rahul Nutakki @ardur_sec]

Prompt injection just tricked AWS Kiro into rewriting its own MCP config to run attacker code.

This is why agent governance matters. Ardur validates every tool call, logs a signed receipt, kills the session if config mutation goes out of band.

https://t.co/BiCfhWDsWp

[Gnani Rahul Nutakki @ardur_sec]

Vibe coders: help make secure-by-construction agent UX normal.

High-value work: Ollama quickstart, receipt explorer, binary-safe secret scan, PWA status, docs, examples and domain packs. Repo is early; contributors can shape the defaults.

https://t.co/kapfx3uPZg

[Gnani Rahul Nutakki @ardur_sec]

If your AI agent made an unauthorized tool call right now, would you know?

Most teams can't answer this. Ardur exists to make the answer always "yes."

Every action. Logged. Signed. Auditable.

https://t.co/BiCfhWDsWp

[Gnani Rahul Nutakki @ardur_sec]

AI agent security isn't just about model alignment.

It's about what happens AFTER the model decides to act:
→ Tool call validation
→ Delegation scope enforcement
→ Per-action audit receipts
→ Rate limiting & budget caps
→ Emergency kill-switch

Ardur makes all of this runtime-enforced:
https://t.co/9nuLBCT6sN

[Gnani Rahul Nutakki @ardur_sec]

Most teams deploying AI agents have zero visibility into what tools they call.

No audit trail. No policy enforcement. No kill switch.

Ardur sits between your agents and disaster:
✅ Per-tool governance proxy
✅ Cryptographic receipts for every action
✅ Delegation narrowing + rate limiting
✅ Kill-switch for emergencies

https://t.co/9nuLBCT6sN

[Gnani Rahul Nutakki @ardur_sec]

Doctors, lawyers, educators, construction teams and workers need different AI boundaries. The common questions: authority, approval, privacy, cost and evidence.

Ardur is early. Domain experts: help turn these into policies and evals.

https://t.co/kapfx3uPZg

[Gnani Rahul Nutakki @ardur_sec]

On a job site, AI can help with notes, checklists, translation and incident records. It must not improvise safety decisions or act without accountability.

Ardur's policy + receipt model is promising, not certified. Workers should shape it.

https://t.co/kapfx3uPZg

[Gnani Rahul Nutakki @ardur_sec]

Monitored agent: "we can see what happened after the damage."

Governed agent: "we stopped it before it happened."

Dashboards after the fact won't catch an agent that already executed the tool call. Policy enforcement BEFORE the call is the only safe posture for production AI.

Ardur is the governance layer — not a post-incident dashboard.

https://t.co/9nuLBCT6sN

[Gnani Rahul Nutakki @ardur_sec]

Most AI security discourse stops at model alignment.

The harder problem: what happens AFTER the model decides to act.

→ Tool call validation
→ Delegation scope enforcement
→ Per-action audit receipts
→ Rate limiting & budget caps
→ Emergency kill-switch

That layer is where production agents actually fail — and where Ardur makes it runtime-enforced.

https://t.co/9nuLBCT6sN

[Gnani Rahul Nutakki @ardur_sec]

Hugging Face just had to throw models at a fully autonomous cyberattack in real time.

This is the exact moment agent security becomes non-optional.

When an AI agent can take actions for you, the question isn't whether the model is aligned. It's whether every tool call it makes is validated, logged, and revocable.

Ardur sits between your agents and the blast radius:
✅ Per-tool governance proxy
✅ Signed audit receipts for every action
✅ Delegation narrowing + rate limits
✅ Kill-switch for emergencies

Open source: https://t.co/9nuLBCT6sN

[Gnani Rahul Nutakki @ardur_sec]

Trae Agent's setup includes bash + file-edit tools and makes Docker isolation an operator choice. It also records model interactions and tool use in trajectories.

Useful? Yes. Risk-free? No. Broad authority needs policy and evidence.

https://t.co/kapfx3uPZg

[Gnani Rahul Nutakki @ardur_sec]

Runtime governance should not live only in policy docs. When an agent calls a tool, the boundary has to be close to the action and leave tamper-resistant evidence behind. Building that path in Ardur: https://t.co/BiCfhWDsWp

[Gnani Rahul Nutakki @ardur_sec]

Agent IAM keeps coming up because naming an agent is only step one. The harder question is: what did it touch, under which boundary, and can you prove it later? That is the Ardur bet: https://t.co/BiCfhWDsWp

[Gnani Rahul Nutakki @ardur_sec]

AI coding tools are becoming privileged workflows. If they can read repos and run commands, 'the chat looked fine' is not enough evidence. Ardur records allowed/denied/unknown agent actions as receipts: https://t.co/BiCfhWDsWp

[Gnani Rahul Nutakki @ardur_sec]

The agent-risk story is not just prompt injection. It is what the agent was allowed to do after the prompt: files, shell, APIs, delegation. Ardur is building action-time boundaries and signed receipts for that work: https://t.co/BiCfhWDsWp