---
title: "Discussion on \"Your Access Controls Are Fine. Your Assistant Still Assembled the Layoff List.\" | Hashnode"
description: "Discussion on \"Your Access Controls Are Fine. Your Assistant Still Assembled the Layoff List.\". A proxy that understands the code-of-conduct and analyzes queries and questions to enforce policies."
url: "https://hashnode.com/posts/your-access-controls-are-fine-your-assistant-still-assembled-the-layoff-list/6a96fd6e527a6891015d760d"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Your Access Controls Are Fine. Your Assistant Still Assembled the Layoff List.](https://breakglass.hashnode.dev/your-access-controls-are-fine-your-assistant-still-assembled-the-layoff-list?utm_source=hashnode&utm_medium=feed)

A proxy that understands the code-of-conduct and analyzes queries and questions to enforce policies.

Sep 1 · 9 min read · breakglass.hashnode.dev  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#rag](https://hashnode.com/tag/rag)
-   [#hr](https://hashnode.com/tag/hr)
-   [#legal](https://hashnode.com/tag/legal)
-   [#ai](https://hashnode.com/tag/ai)
-   [#mcp](https://hashnode.com/tag/mcp)
-   [#proxy](https://hashnode.com/tag/proxy)
-   [#enforce](https://hashnode.com/tag/enforce)

## Written by

[Christian Johannsen](https://hashnode.com/@cjohannsen)

@cjohannsen · Gilbert, AZ

  
[View profile](https://hashnode.com/@cjohannsen)

Container security, supply chains, and the tooling gaps nobody built yet

I'm a Staff Solutions Architect at Chainguard, where I help teams adopt secure software supply chains. My career spans from early '90s networking through modern DevSecOps, container security, and AI implementations. Break Glass Notes is where I write about the practical gaps I hit in the field — the questions dashboards can't answer, the feeds that don't exist, and the tooling I end up building to fill them. Expect posts on container images, SBOMs, FIPS compliance, CVE tooling, and the occasional deep dive into registry APIs.

## Responses 2

Markdown supported · ⌘↵ to post

[Cai](https://hashnode.com/@cailab)

[Sep 2](https://hashnode.com/posts/your-access-controls-are-fine-your-assistant-still-assembled-the-layoff-list/6a96fd6e527a6891015d760d/comment/6a97e0f2bfc57027b71d976d)

Aggrete addresses the gap that RBAC never could. Resource-level access control and cross-resource aggregation are different problems, and no gateway on the market handles the second one.

There is another angle here. If the assistant authenticates with its own identity instead of inheriting the user's full permission set, the aggregation problem becomes harder to trigger. Each task chain starts clean with short-lived credentials. The assistant never had the broad scope, so it cannot accumulate a dangerous combination across sessions.

This does not replace what Aggrete does. Some tasks genuinely need access to multiple systems, and aggregation detection is the right tool for those. But identity separation changes the default from "the assistant can see everything I can see" to "the assistant can see what this task requires."

[Christian Johannsen](https://hashnode.com/@cjohannsen)

[Sep 2](https://hashnode.com/posts/your-access-controls-are-fine-your-assistant-still-assembled-the-layoff-list/6a96fd6e527a6891015d760d/comment/6a97e0f2bfc57027b71d976d#reply-6a982d5b2924ac06dd738dea)

Good catch on the gateway line! It was overstated, and I've rewritten it. The narrower claim: the good gateways do read content, they just classify one payload at a time, and aggregation is a judgment about a set.

On the identity: real control, but scoped credentials bound what an agent can reach, not what it can synthesize from what it legitimately reached. If a task needs CRM and payroll, the scoped token carries both, exactly the combination worth flagging. Cross-session accumulation also survives rotation, since retention happens in outputs and memory, not tokens.

And "never had the broad scope" assumes scope is knowable before execution, which dynamic tool discovery undercuts. Identity separation shrinks the scope; aggregation control governs what's left inside it. Different layers from my perspective.