Hacker News Reader

Comment by syllogism | Hacker News Reader

I want to draw deterministic boundaries around what the agent can do. I don't want a probabilistic approach to security.

My view is that if the agent can decide to do something, nothing stops that thing from being done accidentally, and any attacker that can inject text into its context can do that thing.

View on HN

Deterministic boundaries appear to be best solved with sandboxes/microVMs/remote infra and unique identities with probabilistic guardrails on top. The old deterministic allow/deny list running on bare metal didn't meaningfully solve the problem of giving Claude determinism. Humans got approval fatigue, and eventually, Claude got access to something like 'python3 FILE.py' and Claude could go to the races by updating 'FILE.py'.

The allow/deny list functionality was trash though. If I have a once-off workflow and I want to execute Claude within it, I can't even give it a whitelist of allowed tools.

I definitely prefer auto-mode to the granularity of prompts I was getting from Claude. But I also want to be able to use deterministic rules, and Claude Code's functionality for it sucks.

Simple solution, don't use an indeterministic tool to do things that require deterministic constraints?

They aren't. Allowlists are a deterministic tool. That's the whole point: instructing an llm to review itself is nondeterministic, and thus not a good tool for permissions, compared to allowlists, which are.

In my experience, Allowlists are not deterministic because the #1 thing the LLM does is write python scripts nearly every prompt and ask permission to execute its latest script. I know of no developers who review that code since it would make the process too slow to be useful. So YOLO! Yes, Claude/Codex/Gemini, you can execute the python you just wrote, even though I didn't review it and you have access to the entire machine and so every command I didn't give permission to execute you could just have written the equivalent python.

Agentic interaction is not deterministic. That's the entire deal.

Yes, but we are not restricted to agentic interaction only. We can always pass our inputs and outputs through deterministic filters (which is sort of the point of MCP servers and tool calling, for some use cases).

Reply on news.ycombinator.com