What if the network was the sandbox?
summary
Claim: putting authN/authZ at the network layer prevents key exfiltration by giving the agent a placeholder instead of a real key and forcing every LLM call through an LLM gateway. Implementation: Aperture runs on Tailscale’s WireGuard identity tailnet, logs every request and extracts tool calls — demos show a PR-review bot with three simultaneous commands, bash-heavy activity, and per-request costs (examples: $0.20 and $0.04), plus quotas, webhooks, and a tsnet SDK to build the same stack.
AI-written summary · about
chapters (15)
- 0:00Introduction and the concept of a sandbox
- 1:15Breaking down the components of a sandbox (boundary and permissions)
- 1:52How permissions are typically handled (API keys vs. OIDC)
- 3:18Introducing Tailscale and WireGuard for network-level identity
- 5:42Introduction to Aperture (AI Gateway)
- 7:28Live demo: Viewing usage metrics and logs in Aperture
- 9:47Live demo: Inspecting GitHub Actions PR review bot logs
- 10:39Visibility into tool calls, bash commands, and MCP requests
- 11:46Agent setup and configuration in Aperture
- 13:59Advanced features: Cost controls, quotas, and webhooks
- 15:35Using tsnet to build custom internal identity-aware services
- 17:03Q&A: How to configure permissions (Grants vs. ACLs)
- 18:46Q&A: Network-layer transparency for base URLs
- 20:25Q&A: Permissioning based on users vs. model/provider
- 21:28Q&A: Handling non-tool call agent behaviors (direct code execution)
related talks
30mApplication network security and observability in an encrypted future
11mRethinking Remote Access in a Remote First World
30mSandboxing Agentic AI With LSM-BPF
39mTrust, but Sandbox: Securing AI Agents in Kubernetes
28mAgent Runtime Security: Enforce, Attest, Decide
40mSecuring User to Service Access in Kubernetes
24mTransform Your Network: Master API Control & Security
34mZero Secrets: Building Secure Infrastructure for AI Agents