---
id: "nr-agent-control-is-being-enforced-in-the-runtime-around-the-model-d2d400"
slug: "agent-control-is-being-enforced-in-the-runtime-around-the-model-d2d400"
type: "raw_signal"
title: "Agent control is being enforced in the runtime around the model"
description: "AWS, Uber, Anthropic and Google all place agent safety in runtime layers: lifecycle controls, limits on what an agent can read and execute, network isolation at the environment level, and observable behavior."
observed_at: "2026-10-21T13:22:14.659Z"
record_date: "2026-10-21"
date_kind: "observed_at"
novelty: "notable"
source_platform: "newruntime.com"
topics: ["anthropic","google"]
entities: ["Amazon Web Services","Trust in Depth","Uber","Anthropic","AI Detection and Response (ADR)","Enterprise Frontier Safeguards","Philip Martin","Claude","Irregular","Google"]
related_patterns: ["agent-security-moves-to-runtime-boundaries","verification-bandwidth-is-the-scarce-resource","agent-ready-software-exposes-capabilities"]
source_url: "https://aws.amazon.com/blogs/machine-learning/trust-in-depth-giving-agents-more-autonomy-without-losing-control"
source_urls: ["https://aws.amazon.com/blogs/machine-learning/trust-in-depth-giving-agents-more-autonomy-without-losing-control","https://claude.com/resources/articles/uber-s-ciso-on-building-an-insider-threat-program-for-ai","https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals","https://blog.google/innovation-and-ai/technology/safety-security/gemini-4-model-safety-security","https://daniellemorrill.com/blog/how-my-agents-use-my-passwords","https://aws.amazon.com/blogs/machine-learning/building-agents-that-transact-with-anchor-browser-and-agentcore-payments"]
why_it_matters: "AWS, Uber, Anthropic and Google all place agent safety in runtime layers: lifecycle controls, limits on what an agent can read and execute, network isolation at the environment level, and observable behavior. Machine-level secret storage and payment budgets set outside the agent follow the same approach. The practical consequence is that permissions, credentials and spend limits belong in the infrastructure an agent runs in. Prompts and refusal training alone are not enough."
verification_level: "source-linked"
signal_type: "synthesis"
synthesis_of: [{"slug":"trust-in-depth-giving-agents-more-autonomy-without-3ff173","title":"Trust in Depth: Giving agents more autonomy without losing control","url":"https://newruntime.com/posts/trust-in-depth-giving-agents-more-autonomy-without-3ff173/"},{"slug":"uber-s-ciso-on-building-an-insider-threat-6196c2","title":"Uber's CISO on building an insider threat program for AI","url":"https://newruntime.com/posts/uber-s-ciso-on-building-an-insider-threat-6196c2/"},{"slug":"in-the-blog-post-anthropic-says-it-identified-d21030","title":"In the blog post, Anthropic says it identified most of the cases through a review of transcripts that began in July, and says that these cases have minimal real-world impact — less severe from an a...","url":"https://newruntime.com/posts/in-the-blog-post-anthropic-says-it-identified-d21030/"},{"slug":"developing-gemini-4-argon-responsibly-and-safely-analysis-442f9c","title":"Developing Gemini 4 Argon responsibly and safely","url":"https://newruntime.com/posts/developing-gemini-4-argon-responsibly-and-safely-analysis-442f9c/"},{"slug":"no-more-data-entry-how-to-set-up-c9af92","title":"No more data entry - how to set up your agents to use your passwords.","url":"https://newruntime.com/posts/no-more-data-entry-how-to-set-up-c9af92/"},{"slug":"building-agents-that-transact-with-anchor-browser-and-4eb8cb","title":"Building agents that transact with Anchor Browser and AgentCore payments","url":"https://newruntime.com/posts/building-agents-that-transact-with-anchor-browser-and-4eb8cb/"}]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "signal:agent-control-is-being-enforced-in-the-runtime-around-the-model-d2d400"
retrieval_nugget: "AWS, Uber, Anthropic and Google all place agent safety in runtime layers: lifecycle controls, limits on what an agent can read and execute, network isolation at the environment level, and observable behavior. AWS, Uber, Anthropic and Google all place agent safety in runtime layers: lifecycle controls, limits on what an agent can read and execute, network isolation at the environment"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/signals/agent-control-is-being-enforced-in-the-runtime-around-the-model-d2d400/","markdown":"https://newruntime.com/signals/agent-control-is-being-enforced-in-the-runtime-around-the-model-d2d400.md","json":"https://newruntime.com/signals/agent-control-is-being-enforced-in-the-runtime-around-the-model-d2d400.json"}
---

# Agent control is being enforced in the runtime around the model

## Retrieval answer

AWS, Uber, Anthropic and Google all place agent safety in runtime layers: lifecycle controls, limits on what an agent can read and execute, network isolation at the environment level, and observable behavior. AWS, Uber, Anthropic and Google all place agent safety in runtime layers: lifecycle controls, limits on what an agent can read and execute, network isolation at the environment

AWS, Uber, Anthropic and Google all place agent safety in runtime layers: lifecycle controls, limits on what an agent can read and execute, network isolation at the environment level, and observable behavior. Machine-level secret storage and payment budgets set outside the agent follow the same approach. The practical consequence is that permissions, credentials and spend limits belong in the infrastructure an agent runs in. Prompts and refusal training alone are not enough.

From the Field Notes:

- [Trust in Depth: Giving agents more autonomy without losing control](https://newruntime.com/posts/trust-in-depth-giving-agents-more-autonomy-without-3ff173/) (2026-10-21)
- [Uber's CISO on building an insider threat program for AI](https://newruntime.com/posts/uber-s-ciso-on-building-an-insider-threat-6196c2/) (2026-10-16)
- [In the blog post, Anthropic says it identified most of the cases through a review of transcripts that began in July, and says that these cases have minimal real-world impact — less severe from an a...](https://newruntime.com/posts/in-the-blog-post-anthropic-says-it-identified-d21030/) (2026-10-15)
- [Developing Gemini 4 Argon responsibly and safely](https://newruntime.com/posts/developing-gemini-4-argon-responsibly-and-safely-analysis-442f9c/) (2026-10-17)
- [No more data entry - how to set up your agents to use your passwords.](https://newruntime.com/posts/no-more-data-entry-how-to-set-up-c9af92/) (2026-10-15)
- [Building agents that transact with Anchor Browser and AgentCore payments](https://newruntime.com/posts/building-agents-that-transact-with-anchor-browser-and-4eb8cb/) (2026-10-17)

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- topic hub: [Google](https://newruntime.com/topics/google.md): Explore the google topic hub.
- collection: [Raw Signals](https://newruntime.com/signals.json): Open every source-linked raw signal.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)