The Closed Track: Shrinking an AI Agent's Blast Radius Part 4
A code-running agent tool inherits its pod's blast radius. NetworkPolicy, a dropped ServiceAccount token and gVisor shrink it — and a blast-radius report shows which layers actually hold.
A code-running agent tool inherits its pod's blast radius. NetworkPolicy, a dropped ServiceAccount token and gVisor shrink it — and a blast-radius report shows which layers actually hold.
The account/region/env directory hierarchy that replaces Terraform workspaces, Terragrunt's built-in navigation functions, OIDC hub-and-spoke multi-account auth, and the one-time bootstrap that sets it all up.