Don’t give AI agents root. Make them propose the next system state.
The author argues that autonomous agents should not be given root access to production machines, since agent behavior is nondeterministic and root access offers no reproducibility. He proposes that agents run in short-lived isolated workloads, observe immutable hosts, and submit pull requests for the next system image, which then passes review, build, signing and release before the host consumes it. He states that the agent identity should be able to propose changes without approving, merging, altering pipelines, or signing images. The post is written by a Kairos maintainer and describes a go-ukify alignment fix found by an agent during QA.
What changes for platform teams
Platform teams evaluating agents on infrastructure can treat agent write access as a separation-of-authority question: agents propose changes through the same review and build pipeline as humans, with no direct host mutation. The post describes an architectural pattern rather than a shipped product feature.
Read the original at CNCF Blog ↗
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules