Agentic Security: Permissions, Provenance, and the Agent Supply Chain
Steve Yegge
- When
- Tuesday, June 302:25 PM – 2:45 PM · 20 min
- Where
- Track 5San Francisco, CA · imported from ai.engineer's public schedule feed
About this session
As AI agents move from demos into production engineering workflows, the security boundary shifts from code alone to the permissions, tools, prompts, dependencies, credentials, and orchestration layers that agents can touch. This talk frames agentic security broadly: least-privilege agent permissions, sandboxing and capability design, provenance for agent-generated changes, risks in agent/tool/package supply chains, and practical patterns for keeping autonomous coding and operational agents auditable and containable.
Speaker
Icon, Gas Town
Steve Yegge is a longtime software engineer and technical writer known for his work on developer tools and software engineering.
More in Security
- Through the AI Fog: The architectural decision the next 24 months of agentic security depends on.Tuesday, June 30 · 10:45 AM – 11:05 AM · Track 5
- Your LLM Stack Is a 2008 Database With Better Marketing: Why ML Security Is Dominated by Misconfiguration, Not Missing FeaturesTuesday, June 30 · 11:10 AM – 11:30 AM · Track 5
- We Gave an Agent Production Code Access and Then Tried to Sleep at NightTuesday, June 30 · 11:40 AM – 12:00 PM · Track 5
- Agentic Development SecurityTuesday, June 30 · 12:05 PM – 12:25 PM · Track 5
- Using LLMs to Secure Source CodeTuesday, June 30 · 1:30 PM – 1:50 PM · Track 5
For developers: this programme is open data — JSON, iCal, schedule XML and an MCP endpoint.Show endpointsHide
- JSONEvery published session and speaker, in one request./aie-worldsfair-2026-import/feed.json
- iCalSubscribe in Google, Apple or Outlook Calendar./aie-worldsfair-2026-import/feed.ics
- Schedule XMLfrab / pentabarf — the format conference apps import./aie-worldsfair-2026-import/feed.xml
- MCP + RESTPoint Claude at the programme. OpenAPI 3.1 included./agents
No key, no signup, CORS open. Everything here is generated from the same data the organisers edit.