Tethered: Our Agents Are Us - Shu Fang, Two Sigma

Enterprises can safely let cloud agents run under full user identities - rather than separate machine identities - by combining trace-based attribution headers w...

By Sean Weldon

Tethered: Our Agents Are Us - Identity Architecture for Enterprise Cloud Agents

Abstract

This synthesis examines a production architecture in which cloud-based coding agents operate under the full identity of the human user rather than a dedicated machine identity. Developed at a quantitative investment firm, the approach repurposes existing per-user Kubernetes namespace infrastructure to run agents with genuine user credentials, then mitigates the resulting risks through two complementary controls: a trace ID-style header propagated across every agent action for human/agent attribution, and enterprise-controlled web grounding that constrains external retrieval to the corporate network boundary. The design is framed explicitly as a risk-return optimization analogous to the Sharpe ratio. Reported outcomes include a managed fleet of per-user agents accessible via CLI, mobile, Slack, and browser, deployed with no additional provisioning burden and, in the authors' assessment, no loss of expected value despite reduced risk exposure. The findings carry implications for identity architecture, observability design, and controlled egress in agentic systems.

1. Introduction

The general availability of Claude Code in June 2025 catalyzed rapid enterprise adoption of local, command-line-interface (CLI)-based coding agents. While demonstrably powerful, this deployment mode is constrained in two respects: it is localized to a developer's workstation, and it is CLI-bound, excluding the substantial population of enterprise users who do not operate comfortably in terminal environments. The logical extension is toward cloud agents - processes executing remotely and invocable from mobile devices, chat platforms such as Slack, and browsers.

This extension immediately raises an identity question. An agent acting remotely on a user's behalf must authenticate against internal systems, and the credential it is granted determines both its capability and its control surface. Two candidate architectures exist: a machine identity, in which the agent operates under a distinct, dedicated principal separate from the human; and a tethered identity, in which the agent inherits the user's own full identity and permissions. This analysis is organized around the central thesis that the tethered model, though intuitively riskier, is the more viable enterprise pattern when paired with two engineered controls - deterministic attribution metadata and curated web egress.

The remainder of this synthesis proceeds as follows. Section 2 situates the problem against the failure modes of the conventional machine-identity pattern and the analytical traditions the solution draws upon. Section 3 presents the core architecture and its two risk-mitigating mechanisms in detail. Section 4 distills actionable technical insights and trade-offs. Section 5 discusses broader implications, and Section 6 concludes with practical takeaways.

2. Background and Related Work

The conventional enterprise pattern for non-human actors is a dedicated machine identity - informally, a user's "shoe" paired with a shadow "shoe agent." This pattern is well established for batch jobs and service accounts and offers a clean audit boundary in principle: any action attributed to the machine identity was, by construction, not performed by the human. In practice, the pattern proved unworkable for agent deployment across four dimensions: continuous permission synchronization drift between human and shadow entitlements; duplicated software licensing for per-seat tools; systems architecturally incapable of supporting multiple identities on shared data, with Google Workspace cited as a canonical example; and unbounded public/private boundary management questions regarding which private artifacts a shadow identity may access.

The substituting architecture draws on two adjacent intellectual traditions. From distributed systems observability comes the trace ID, a correlation token propagated through every hop of a call chain to reconstruct provenance after the fact. From quantitative finance comes risk-adjusted return reasoning, in which a system's capability is optimized not in isolation but as a ratio against measured risk exposure - explicitly likened to the Sharpe ratio in this context.

3. Core Analysis

3.1 Repurposing Namespace Infrastructure for Identity Inheritance

The architecture leverages infrastructure that predates the agent initiative: Kubernetes clusters with per-user namespaces already deployed across all operating regions to support automated jobs, code containers, and research notebooks. Extending this infrastructure to agents required no new provisioning model. A trigger event invokes a controller that spins up compute resources within the user's existing namespace; a sidecar pod then pulls the user's identity from a separate identity service and mounts it into the container, so that the agent process executes with the user's actual credentials rather than a synthetic principal. Because the namespace, licensing, and permission set already exist for the user, this removes the capability constraints - and the synchronization burden - that doomed the machine-identity pattern. The practical consequence is that promoting an agent to a given user requires no additional infrastructure work; only standard production support and security review are needed, as with any other application.

3.2 Attribution via Propagated Trace Headers

Running an agent under the user's own identity eliminates the built-in audit boundary that a machine identity would have provided, creating an internal danger: the inability to distinguish whether a given action originated from the human or the agent. The solution adapts the observability concept of a trace ID into a header (referred to as an XSLM agent header) that is appended to at every agent step. This header is enforced deterministically across HTTP clients, MCPs (Model Context Protocols), and skills, since these components sit within a controlled harness rather than being arbitrary external code. Unlike the shadow-identity approach, which reveals only the initiation point of an action, the propagated header yields a full, replayable provenance chain across the entire sequence of agent steps. Critically, the header is acknowledged as insufficient in isolation, since it is spoofable; security depends on combining it with the underlying user identity, which remains non-mimickable, to achieve full traceability.

3.3 Constraining External Access via Enterprise Web Grounding

The second danger is external: LLM-based agents require open internet access for tasks such as search and retrieval, exposing the firm to exfiltration of intellectual property or sensitive data, prompt injection from untrusted content, malware and vulnerability exposure, and unlicensed-content or copyright risk. Rather than granting native web search and fetch tools - such as those Claude Code defaults to, backed by a Brave index - the architecture explicitly denies these native tools and redirects all web access through Google Web Grounding for Enterprise. This product provides search and fetch functionality within the firm's existing VPC and network controls, avoiding external egress altogether. The tradeoff is data freshness: content is generally current within 24 hours, and within 6 hours for more frequently updated sites. This lag is assessed as acceptable for the large majority of agent use cases, and the index carries additional curation and safety guarantees suited to regulated industries.

4. Technical Insights

Several implementation-level findings merit emphasis for practitioners considering similar architectures:

5. Discussion

The architecture's central contribution is reframing agent security not as a binary access decision but as a risk-return optimization, explicitly analogized to the Sharpe ratio: the objective is to maximize capability captured per unit of risk incurred, rather than minimizing risk absolutely at the expense of capability. This framing has broader relevance beyond the specific firm, since many enterprises face an analogous choice between constrained-but-safe machine identities and capable-but-riskier user-tethered identities. The claim that the firm "did not lose expected value while hugely reducing the risk" rests on the assertion that gains in observability (via the trace header) offset losses from index staleness - a claim that would benefit from further quantitative validation across a broader set of agent workloads.

A notable industry pattern illustrated here is that regulated enterprises can convert generative AI risks generally perceived as unmanageable - prompt injection, exfiltration, licensing exposure - into bounded, engineered problems by routing agent capabilities through existing enterprise-controlled infrastructure (VPC-bound web grounding, existing namespace and licensing structures) rather than building new trust boundaries from scratch. This suggests a broader principle: agent risk mitigation may be more tractable when treated as an extension of existing infrastructure governance than as a novel security discipline.

Open questions remain regarding the long-term viability of dependency on third-party frontier models for both the agent harness and the grounding index; the authors express interest in self-managed local or open-weight LLMs to reduce cost volatility and insulate against model deprecation or degradation risk.

6. Conclusion

This analysis presents a production case for tethering cloud agents to full user identities rather than isolating them behind machine identities, contingent on two engineered controls: trace-based attribution headers for internal accountability and enterprise-controlled web grounding for external safety. The reported outcome is a managed, multi-interface agent fleet requiring no incremental infrastructure provisioning, achieved at reduced risk without apparent loss of capability. For practitioners, the key takeaway is that agent identity architecture should be evaluated as a risk-return optimization built atop existing enterprise infrastructure, rather than a categorical choice between full access and full isolation.

Sources

About the Author

Sean Weldon is an AI engineer and systems architect specializing in autonomous systems, agentic workflows, and applied machine learning. He builds production AI systems that automate complex business operations.

LinkedIn | Website | GitHub