Viewing profile — ryanrasti

For three years I worked as CTO of a startup building a huge Postgres app (a WMS) from scratch. We had 100+ inter-related tables and the complexity of delivering feature after feat…

Typegres - SQL over RPC safely (safely compose queries over Cap'n Web): At a high level: 1. Define your schema: TS classes model each one of your underlying tables. 2. Encapsulate …

Funny, the same thing stuck out to me from Cloudflare OS's README ( https://github.com/cloudflare/cloudflare-os#contributing ): > At this time, we are not seeking outside contribut…

Every app I've built required the core data model to be rephrased four times: schema, ORM, controller, DTO. The "API" layer was just translation between them. I wanted clients to c…

> We need fine grained permissions per-task or per-tool in addition to sandboxing. For example: "this request should only ever read my gmail and never write, delete, or move emails…

I'm the author, you may find interesting: 1. Instead of building a new checker, TypeNix maps Nix's AST directly to TypeScript's AST. The standard TS binder, type checker and LSP wo…

I think what you're saying is agent can write to an intermediate file, then read from it, bypassing the taint-tracking system. The fix is to make all IO tracked by the system -- if…

Big kudos for bringing more attention to this problem. We're going to see that sandboxing & hiding secrets are the easy part. The hard part is preventing Fiu from leaking your enti…

> decades ago securesm OSes tracked the provenience of every byte (clean/dirty), to detect leaks, but it's hard if you want your agent to be useful Yeah, you're hitting on the core…

This is a really good question because it hits on the fundamental issue: LLMs are useful because they can't be statically modeled. The answer is to constrain effects, not intent. Y…

Exactly! The key is making the filters composable and declarative. What's your use case/integrations you'd be most interested in?

Great to see more sandboxing options. The next gap we'll see: sandboxes isolate execution from the host, but don't control data flow inside the sandbox. To be useful, we need to ho…

Yeah you're right security is ground zero - it's where "LLM said it's fine" first stops being acceptable. My worry: industry is pushing "LLM guarding LLM" as the solution because i…

This is exactly right. One layer I'd add: data flow between allowed actions. e.g., agent with email access can leak all your emails if it receives one with subject: "ignore previou…

You hit on a good point: once we have more tools, we need more comprehensive policy & all dataflows needs to be tracked. There's different policies that could fix your example. e.g…

Building ExoAgent: a security layer for AI agents that enforces data flow policy, not just access control. The problem: agents like OpenClaw can read your email and post to Slack. …

With OpenClaw hitting >150k stars, clearly there's demand for personal AI agents. But I keep hearing the same hesitation: "I want this, but I can't trust it with my real data." For…

Thanks! > I'd be interested to hear more about how you handle the provenance tracking in practice, especially when the agent chains multiple data sources together. When you make a …

Yes, agree with the general idea: permissions are fine-grained and adaptive based on what the agent has done. IFC + object-capabilities are the natural generalization of exactly wh…

Yeah, those are valid approaches and both have real limitations as you noted. The third path: fine-grained object-capabilities and attenuation based on data provenance. More simply…

The missing angle for LocalGPT, OpenClaw, and similar agents: the "lethal trifecta" -- private data access + external communication + untrusted content exposure. A malicious email …

I resonate strongly with your framing. LLMs as suggestion engines, deterministic layer for execution. I'm building something similar with security as the focus: deterministic polic…

Precisely! There's a fundamental tension: 1. Agents need to interact with the outside world to be useful 2. Interacting with the outside world is dangerous Sandboxes provide a "def…

Yes exactly Cap'n Web for RPC. On top of that: 1. Constrained SQL DSL that limits expressiveness along defined data boundaries 2. Constrained evaluation -- can only compose capabil…