evolver

Least-privilege permissions

• Start with minimal capabilities. When deploying Evolver agents, grant them only the specific data access and tools they need to perform their assigned task. Do not give them blanket access to all company systems.
• Sandbox evolution changes. New capabilities that agents develop during evolution should not automatically apply to production environments. Test evolved agents in isolated environments first.
• Require approval gates. Set up a human review process before major evolved changes (called "Genes" or "Capsules" in Evolver terminology) are deployed to live systems.
• Use role-based restrictions. Assign agents narrow roles—for example, "read-only access to customer data" rather than "modify customer data"—and prevent agents from requesting permission escalation during evolution.

Network isolation

• Restrict outbound connections. Configure firewalls to prevent Evolver agents from connecting to unexpected external services or data sources without explicit authorization.
• Segment agent environments. Run Evolver agents on separate network zones from sensitive systems (finance, HR, intellectual property). Prevent agents from pivoting between zones.
• Disable internet access by default. Unless the agent explicitly needs to fetch external data, block all internet connectivity and require manual approval to enable it.
• Monitor API and database calls. Log all connections agents make to internal databases and APIs to detect unauthorized resource access.

Monitoring

• Audit all evolution events. Evolver logs changes to agent behavior (called "Events"). Review these logs weekly to understand how agents are changing and catch unexpected mutations.
• Track capability drift. Monitor what tools and data sources agents request over time. Alert if an agent suddenly requests new permissions or capabilities unrelated to its original purpose.
• Set behavior baselines. Establish normal patterns for what an agent should do (decisions it makes, data it accesses), then flag deviations as potential security issues.
• Use real-time alerting. Configure automated alerts for high-risk behaviors, such as attempts to access restricted data, make external network calls, or spawn new agents.

Red flags to watch for

• Unprompted permission requests. If an agent requests new capabilities or data access that was not explicitly programmed, investigate before granting.
• Unexpected prompt changes. If an agent's instructions or reasoning logic evolve in ways unrelated to your business goals, disable the agent and review its evolution history.
• Circular or recursive evolution. If agents are creating offspring agents or evolving other agents without human oversight, this dramatically increases risk and should be halted.
• Degraded audit trails. If logs of Genes or Events become incomplete, inconsistent, or difficult to parse, you cannot verify the agent's safety—treat this as a critical incident and isolate the agent.