piso · AI security workshop
Run agents
with boundaries
Monday 19 October 2026 · 17:00 UTC · online
git clone https://github.com/piso-dev/pisoHands-on. Install while we start; we build together in a few minutes.
Code · tools · project mount
Held outside the worker
Today
What we'll cover
About ten minutes of setup, roughly fifteen minutes of talk, then we switch to the terminal.
- The problem
- What piso is
- How it solves it
- See it work — then hands-on and Q&A
The problem
Agents can see
all your secrets
An agent working in your repo and shell can read every credential it can reach — and it usually reaches a lot.
- .env and config files
- Shell history
- ~/.ssh keys
- Cloud CLI credentials
- API tokens in source
- Environment variables
The problem
Agents can access
your private machine
An agent running on your laptop inherits your user account. Your home directory, browser sessions, keys, other projects, and every local service are all within reach.
Your private machine
- Home directory
- Photos and documents
- Browser profiles
- SSH keys
- Other projects
- Local services and ports
What is piso?
A place to run agents
with real work to do
piso runs an AI agent inside an isolated worker, routes its access through a credential gateway, and keeps a human on the decisions that matter.
Isolated worker
A container per task, with one project directory mounted and nothing else.
Credential gateway
The agent holds placeholders; the real keys stay outside its reach.
Human oversight
Approvals and host actions stop and wait for a person.
The solution · Isolation
The worker is not
your machine
One project directory is mounted read-write. Everything else stops at the container boundary.
| Resource | Worker container | Host machine |
|---|---|---|
| Filesystem | Its own container filesystem | Shares exactly one mounted project directory |
| Home directory, SSH keys | Not present | Never mounted or copied into the worker |
| Credentials | Placeholders such as piso_… | Real values held by the gateway |
| Outbound network | Proxied through the credential gateway | Gateway checks the destination and substitutes |
| Listening ports | Only when a route is published | Route maps one worker port to a browser URL |
| Lifetime | Disposable; caches and temp files stay inside | Outlives the worker and decides when it stops |
The solution · Credentials
Placeholders go in.
Keys stay out.
The worker's files and environment hold only placeholder strings. The gateway substitutes the real value on the way out — after checking the destination.
Worker
piso_… placeholder
Gateway
Scope check · substitution
Service
Authenticated request
The solution · Credentials
Set up outside,
scoped to the task
Register a credential with the gateway and scope it to a destination. The worker only ever sees the name.
Secret vault
Workers never receive these values.
- Placeholder
- piso_gh_9f2c…
- Allowed hosts
- api.github.com
- Workers
- web-app
The solution · Credentials
A block is a decision,
not an error
Requests that match the detection rules stop, with the reason attached. Read it before you change anything.
Traffic
Outbound requests, gateway verdicts, and credential findings.
- Address
- https://api.stripe.com/v1/charges
- Worker
- web-app · main / a91f3c
- Reasons
- Credential-like value in request body
- Findings
- sk_live_… in body "card"
- Request ID
- req_8821
The solution · Oversight
Some steps stop
for a human
Approvals and host actions cross the boundary — and wait for you.
Needs you
Decisions the agents cannot finish alone.
Approve a host action
Push the worker's commits to the remote. This crosses the boundary and runs on the host.
git push origin main
Choose a migration window
The worker can apply migrations now or wait for a quiet period.
The solution · Oversight
Watch what moved,
not every terminal
Workers report progress, milestones, and blockers to the board.
Projects
Recent worker activity by project.
Straight talk
What isolation
doesn't cover
Isolation shrinks the blast radius. It does not remove risk.
Keep in the model
- The mounted project is writable, so changes still need review.
- An authorized service can be misused within its scope.
- A service can return sensitive data the agent then handles.
- Detection rules do not catch every leak.
- Host and gateway security decide the real boundary.
Let's see how it works
Four steps, live
Watch the boundary hold while the agent does real work.
Switch to the terminal — the deck can wait here.
- Start a worker on a disposable demo project.
- Let it read something you didn't write.
- Send a request through a scoped placeholder.
- Stop at the block or approval and decide together.
Your turn
Now you try it
- Bring up your own worker.
- Make a change and review the diff.
- Add one scoped credential.
- Trigger a block and read the reason.
Questions and threat models welcome. Write-up and install instructions are on the marketing site.