AI agents become much more interesting when they stop being chat windows and start using tools: reading files, writing drafts, calling APIs, creating issues, and shaping real workflows. At that point, they are no longer just prompts. They are software with permissions.

In this practical session, I’ll use a real CLI-based speaker agent as the example: an agent that helps take a conference talk from rough idea to draft submission material. We’ll start with the naive version that feels impressive in a demo, then progressively add the controls that make it more trustworthy: scoped tools, workspace boundaries, least privilege, approval gates, logging, diff review, and simple policy checks.

This is a builder-focused talk for people experimenting with agents, coding assistants, and autonomous workflows. The goal is not to cover every possible agent security problem. It is to show a small, repeatable pattern for moving from prototype to controlled automation without burying the whole thing under governance theatre.