Defending the Operator's AI: Agents, Credentials and the Control Plane as Tier 0

All courses / AI Operations / Module 4 / Chapter 18

Learning objectives

After the lesson the participant can:

Explain why the operator's AI is a target and which six kinds of asset must be protected together
Match each of the six threat mechanisms to the control outside the model that bounds it
Classify the text an agent reads into writer classes and state what authority each may carry
Draft a permission manifest with named refusals and a set of ceiling cases as a defensive test

Key concepts

Operational text as an instruction channel: A language model receives instructions and data in the same medium and cannot reliably tell them apart, and in operations the retrieved data is tickets, logs, alert annotations and vendor feeds that others can write. The control sits outside the model whoever the author is.
Writer classes: Input provenance by who can write a text: WC-1 instrument output may trigger a catalogued runbook, WC-2 reviewed staff text may define what a runbook does, and WC-3 outside-the-team text and WC-4 external or generated text inform but carry no authority above notify. A summary inherits the lowest class.
Confused deputy: The pattern Hardy named in 1988: a service with authority its requester lacks is led to use it on the requester's behalf. The defence is that authority travels with the request: a token bound to an incident or change record, with audience checks and a tool allow list.
No standing credential: A credential that can change production exists for the length of a run and is issued only after the policy decision point has allowed the action. Each agent has one identity of its own, and no agent holds a human's identity.
Break-glass: A route to operate the control plane when the platform, the decision point or the identity provider is down. It does not depend on what it remedies, needs two named people by default, is time-boxed and recorded, is exercised with a measured time, and is never held or requested by an agent.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Writer classes

Sort each text an operations agent may read into the writer class the chapter assigns to it.

Interactive exercise 2 · Match

Threats and the controls outside the model

Match each threat to the operator's AI with the control outside the model that the chapter pairs with it.

Teaching plan

15 min	The teacher explains why the target is the aggregate of credentials, control plane, runbook library, configuration maps, telemetry and stop path, and why controls are designed for the agent's reach and not its intent.
20 min	Participants complete the mechanism table from memory: for each of the six mechanisms, the consequence if uncontrolled and the control outside the model, described by mechanism only.
20 min	Case reading of the near miss INC-HM-2029-0031: how a ticket summary reached the runner's context, what the decision point refused, what the replay found and what version 1.4.0 of the mandate added.
10 min	Input on the state engine and desired-state repository as Tier 0, on break-glass, and on what to log, where, and who reads it.
30 min	Exercise: participants write a permission manifest with refusals and ceiling cases.
10 min	Debrief with the Monday action: list the identities that can change production and find those that are standing and shared.

Discussion

The review of the near miss found that a restart would have been allowed although the independent probe showed no fault, because the allow rules checked what the agent may do and not what had prompted it. What does that say about allow rules on their own?
Nordvik Region's audit found an administrator key unchanged for 26 months and named on a wiki page, with no agent involved. Why does the chapter count this as part of defending the operator's AI?
When the policy decision point itself fails, the design is to fail closed. What does failing closed cost during an incident, and who operates in the meantime?

Written exercise

Exercise · 30 minutes

A permission manifest with refusals and ceiling cases

For one remediation agent or pipeline, yours or Hansa Mutual's IT-operations agent, list every source of text it reads and assign each a writer class, WC-1 to WC-4, taking the lowest class where a source is mixed. State which classes may trigger a catalogued runbook and which only inform, and the corroboration required before acting on WC-3 or WC-4 text. List the identities and credentials, removing any that are standing. Write the named refusals that hold at every level, including the undelegated classes. Then write ten ceiling cases as a design and review exercise: each describes, by mechanism only, a situation the policy must refuse, with the expected refusal reason.

Deliverable: A permission manifest with writer classes, credential rules and named refusals, plus ten ceiling cases with expected refusal reasons, dated for a first run.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

A customer ticket is summarised by the incident assistant, and the summary reaches the runbook runner. Which writer class does the summary have?
Show the answer
B. WC-3, because a summary inherits the lowest class of what it summarises
The inheritance rule closes the route in which outside text gains authority by being summarised. A ticket body is WC-3, so its summary informs and carries no authority for an action above notify.
Which of these is a property the chapter requires of a break-glass route?
Show the answer
D. It does not depend on what it is a remedy for, and it is exercised with a measured time
The route must work when the identity provider or platform is down, needs two named people, is time-boxed and recorded, and is exercised. Agents never hold it or request it, and a route never used is a claim without evidence.
What did Nordvik Region's test of its break-glass route on 2029-02-07 record?
Show the answer
A. Two named people had access in 9 minutes against a target of 15, with federation disabled in an agreed window
The route is local to the management plane, without federation to the identity provider, and the test gave 9 minutes against 15. The result is valid until 2029-05-07 or a change in the management plane, so the evidence has an age.