ouroboros

Least-privilege permissions

• Enforce budget caps at every evolution stage: Set hard spending limits (API calls, compute time, token usage) that the agent cannot exceed, even during self-improvement. Review and approve any requests to increase budgets before granting them.
• Grant only the minimum access needed: The agent should only connect to the specific data sources and tools it needs for its current task—not blanket access to all company systems or credentials.
• Require explicit approval for new permissions: Any time the agent requests access to new systems, databases, or external services (like payment platforms or customer data), a human must review and approve it first.
• Regularly audit what the agent can access: Every month, check what permissions the agent actually has versus what it should have, and revoke anything that's no longer needed.

Network isolation

• Run evaluations in sandboxed environments: During the "interview" and testing phases, isolate the agent from production systems and sensitive data—use separate test networks that don't connect to real customer or financial information.
• Limit outbound connections: Configure firewalls to restrict where the agent can send data—only allow connections to approved APIs and services, blocking any unexpected external calls.
• Separate runtimes by risk level: Keep high-risk agent versions (experimental self-improvements) on isolated servers away from stable, production-used versions.
• Monitor inter-runtime communication: Since the agent uses 14+ different platforms (Claude, Gemini, etc.), track what data moves between them and ensure no single platform becomes a chokepoint for sensitive information.

Monitoring

• Log every self-modification attempt: Record every time the agent changes its own behavior, including what it tried to change and why—maintain an audit trail that cannot be deleted by the agent itself.
• Track permission requests and changes: Create alerts whenever the agent asks for new access or when a human grants new permissions; flag unusual patterns like frequent escalation requests.
• Monitor API usage and anomalies: Watch for sudden spikes in API calls, unexpected data queries, or attempts to access systems outside normal operating patterns—set automatic alerts for these incidents.
• Review interview-gate decisions: Periodically audit which agents passed evaluation gates and which were blocked; look for patterns where rejection criteria may be getting weaker over time.

Red flags to watch for

• Repeated permission requests: If an agent keeps asking for the same elevated access after being denied, this suggests it may be probing security boundaries rather than operating normally.
• Evasive language in self-improvement logs: Watch for vague descriptions of changes, buried modification requests, or attempts to justify large scope increases—transparency should be the default.
• Unexpected new capabilities: If the agent suddenly performs tasks it wasn't designed for or accesses data it shouldn't know about, stop it immediately and audit what changed during evolution.
• Upstream provider alerts: If any of the 14+ runtime platforms (Claude, Gemini, Copilot, etc.) report security incidents or compromises, assume the agent may be affected until proven otherwise—test it in isolation before returning to production.