Deno gives incident-response agents write access to production systems, and they can resolve incidents that once required a human.
2
Agents must be treated as untrusted software because prompt injection can make them take harmful actions, and MCP permissions do not cover subprocesses or non-HTTP protocols.
3
Claw Patrol controls the bytes leaving an agent at a lower network layer, applies HCL rules, injects credentials, and can require an LLM judge or human approval.
Summary
Ryan Dahl describes how Deno uses agents to handle Deno Deploy incidents with read and write access to Postgres, Kubernetes, ClickHouse, AWS, GitHub, and Slack. The approach works, but an agent connected to a support system can be prompt injected. Dahl argues that model alignment is not a sufficient security boundary. An agent can start psql as a subprocess, use a non-HTTP protocol, and reach production through a path that MCP tools or HTTP proxies do not control. Deno's answer is Claw Patrol, an MIT-licensed proxy that parses traffic below the HTTP layer. Its HCL rules are checked into git and tested with fixture requests. The proxy can block database actions, hold and inject credentials, and route requests to an LLM judge or a human in Slack. A demo shows it stopping Codex from deleting a users table at the Postgres wire protocol.
Deno gives incident agents broad write access because context helps them solve incidents
Deno uses agents to handle Deno Deploy incidents that previously woke up a human. OpenClaw and other agents can access Postgres, Kubernetes, ClickHouse, AWS, GitHub, and Slack, with read and write access. This lets them inspect ClickHouse traces, check which projects a user owns in production Postgres, and read communications and GitHub logs. Dahl says the pattern works well because agents can solve many incidents without a human in the loop. The same access also lets an agent issue dangerous commands such as deleting a users table or removing a production Kubernetes namespace.
Dahl says Opus refuses to delete the users table even when pushed repeatedly. He does not consider that enough. Agents connected to a support system can receive prompt injection from outside, and an attacker may find a string that makes the model believe a harmful action is appropriate. Deno therefore treats agents as untrusted software. The guard cannot live inside the agent, because the agent itself may be manipulated. Running the agent on a standalone VM protects the file system, but it does not decide whether the agent's network actions are safe.
The security system has to inspect every byte leaving the agent
Dahl frames both good and bad agent actions as network communication. An agent can use MCP, but it can also start subprocesses. Postgres is an important example because psql uses a non-HTTP protocol. Deno wants to understand the bytes leaving the agent in detail, regardless of how the connection was created. The difficult case is a production Postgres database inside an AWS VPC, reachable through an EKS endpoint. The desired policy must stop an agent from spawning psql and tunneling through that endpoint to drop the users table.
Permissions and MCP tools leave gaps when access paths compose
Deno still uses careful credential provisioning and access controls, but Dahl says they require coordination across many systems. Access to one system combined with access to another can create an unintended path. MCP tools can expose carefully limited operations, yet the boundary breaks when the agent spawns psql directly. Existing tools cover parts of the problem. LLM gateways inspect traffic to the model provider, HTTP proxies control HTTP methods and paths, credential proxies keep secrets away from the agent, and process sandboxes restrict operating-system actions. None of these alone controls every protocol and route to production.
Claw Patrol is Deno's open-source, MIT-licensed proxy for agents. It sits in front of the agent and parses each byte flowing out of it, rather than inspecting only HTTP requests. The proxy understands protocols such as Postgres and can apply rules even when traffic is tunneled through other systems. It also holds credentials so the agent does not see secret values. Dahl describes a rule system for specifying exactly which requests and actions may leave the agent. A plugin system allows the proxy to support protocols it does not already understand.
HCL rules make agent permissions reviewable and testable
Claw Patrol rules are written in HCL, the configuration language used by Terraform. Deno checks the rule file into git and manages changes carefully. Dahl says Deno's own file is about a thousand lines long and defines permissions for its services in detail. One example blocks selected Postgres functions. The rule file also has a fixture-based test system. Teams can send fixture requests through the rules and write unit tests that verify a request remains blocked. Claw Patrol itself has a larger test suite.
The proxy can stop destructive database actions at the wire protocol
In the demo, Claw Patrol runs Codex in yolo mode, so Codex follows a request to delete the users table from Postgres. Codex starts a psql subprocess, which opens a connection through Claw Patrol. The proxy parses the Postgres traffic, applies its rules, and rejects the destructive action. The dashboard shows agents, requests, denied actions, and actions that need approval. Users can open an action to inspect its details rather than relying on the agent's own explanation.
Rules can reject an action, ask an LLM judge to review it, ask a human in Slack, or combine those steps. For example, an LLM judge can review an action before a Slack approval is requested. This lets Deno keep the agent software unchanged and treat it as a black box. Claw Patrol also injects credentials for cookies, Postgres, ClickHouse, OAuth, and AWS SigV4. The agent sends a placeholder or request through the proxy, while the proxy holds the actual secret.
Better models reduce risk without removing the need for an external boundary
In the question period, Dahl says smarter agents with better context will make harmful behavior less likely. Opus is more aligned than earlier models and may better understand that it works for a company with constraints. He still expects a need for backup security mechanisms because he does not think AIs can ever be fully trusted. His conclusion is that alignment helps, while the security boundary must remain outside the agent and its plugins.
"We really want to understand what the bytes are coming out of that agent in great detail."04:53
Who should watch
You are giving an incident-response agent access to production databases, cloud systems, source control, or team communications and need a boundary outside the model.
Your controls focus on MCP tools or HTTP requests, while agents can start subprocesses and reach systems over database or other non-HTTP protocols.
You want concrete ideas for policy files, fixture-based tests, credential injection, and human or LLM approval before an agent action proceeds.
