Deterministic boundaries appear to be best solved with sandboxes/microVMs/remote infra and unique identities with probabilistic guardrails on top. The old deterministic allow/deny list running on bare metal didn't meaningfully solve the problem of giving Claude determinism. Humans got approval fatigue, and eventually, Claude got access to something like 'python3 FILE.py' and Claude could go to the races by updating 'FILE.py'.
replySimple solution, don't use an indeterministic tool to do things that require deterministic constraints?
replyThey aren't. Allowlists are a deterministic tool. That's the whole point: instructing an llm to review itself is nondeterministic, and thus not a good tool for permissions, compared to allowlists, which are.
replyAgentic interaction is not deterministic. That's the entire deal.
replyYes, but we are not restricted to agentic interaction only. We can always pass our inputs and outputs through deterministic filters (which is sort of the point of MCP servers and tool calling, for some use cases).
reply