Hi, thanks for posting this. I appreciate you not coming from engineering and being laser focused on product building.
There's a real gap identified (execution permission instead of output guardrails). The timing concern is valid (we're scaling agent framework way faster than security infrastructure — see Clawdbot-Moltbot). The default-deny + time-boxed permissions + audit logs is a solid model, easy to discuss at high-level with security teams in an org. The "Auth0 for AI Agents" framing is clear and positions it well.
Actually, the audit log piece is really huge. Having a complete execution trace with authorization decisions is invaluable for incident response. That alone might justify adoption even if the blocking mechanism is imperfect.
My concerns and questions:
- Where exactly does this sit? If it's between the agent and tool calls, that's relatively straightforward. If it needs to intercept arbitrary code execution or API calls, that's significantly harder.
- Adding another authorization layer means more setup, more policy configuration, more potential points of failure. Adoption challenge.
- Who defines what's "allowed"? In what format? How granular? Actually expressing "this agent can do X in context Y at time Z" in a way that's both powerful and usable, that's the whole ballgame (IMHO). I have in mind how complex AWS IAM policies got, and those are for relatively static systems. AI agents are dynamic, context-dependent, and probabilistic.
- By the time Reg sees a request to execute, the LLM has already decided. What happens when you block it? Does the agent gracefully handle denials and retry with different approaches?
I'd be interested in seeing real-world policy examples from your design partners. That'll tell you whether you've found the right abstraction layer.
Congratulations for just framing the idea and getting this far. Being very concerned about the current free-wheeling AI expansion with minimal security, I strongly believe this is going in the right direction and would like to know where this leads.
Actually, "esprit d'escalier" is indeed used in French, though less commonly, especially outside of literary contexts. It refers specifically to the inability to come up with a timely response or comeback (and the frustration of finding the "perfect" reply when the conversation is already over). On the other hand, "présence d'esprit" has a broader usage in everyday language. It can mean having a quick and witty response (the opposite of "esprit d'escalier"), or more broadly, the sudden ability to judge and react appropriately in a situation.
It's very good. I've tried it after hesitating a bit because of the price tag compared to Khan Academy — no regrets.
K.A. is great and I still use with my kid, but M.A. is more condensed and to the point for my needs. I was properly guided through the first program choices according to my profile, and the diagnostic exam you start with was perfect to highlight what I actually need to work on given my limited time.
Explanations and courses are super condensed, with the right amount of example and pedagogy that clicks for me.
It goes even deeper than getting laid if you study Costume History and its psychological importance.
It is a powerful medium of self-expression and social identity yes, deeply rooted in human history where costumes and attire have always signified cultural, social, and economic status.
Drawing from tribal psychology, it fulfills an innate human desire for belonging and individuality, enabling people to communicate their affiliation, status, and personal values through their choice of clothing.
It has always been and will always be part of humanity, even if its industrialization in Capitalistic societies like ours have hidden this fact.
> fashion industry in general is useless to society
> rich jobless people need a place to hangout
You're talking about an industry that generates approximately $1.5 trillion globally, employing more than 60 million people globally, from multi-disciplinary skills in fashion design, illustration, web development, e-commerce, AI, digital marketing.
As a secular Jew in Western Europe, I've distanced myself from my religious community due to its insistence on tying my identity to Israel. Where I live, it's less taboo to critique Israel than in the U.S., but still tricky.
Advocates of Israel's right-wing politics have blurred the line between criticizing Israel and anti-Semitism, an endeavor helped by actual anti-Semites. I've grown up with these supporters, but can't quite call them a "lobby" due to their loose organization and lesser influence here compared to the U.S.
Speaking out brings risks: being labeled a leftist extremist, clashing with fellow Jews, or unwittingly aiding anti-Semites. And that's if you are Jew.
This creates a pervasive, cautious silence that I imagine is even more stifling in countries with highly organized pro-Israel lobbying.
I tried to make it create a file with a silly name that does not pass the lewd language filter.
It elegantly refused replying "cannot touch file <name of file>: permission denied"
>It might be time to lose that space, similar to how we don't double space after period.
Well, that's is a bit like saying "it might be time to write your whenever you mean you're" just because Google Docs' autocorrect feature kept messing up the two when you wrote English.
"The modern web makes me want to throw up", "Electron is flash for the desktop", "Databases have failed the web" — wow... author does not look very happy with the state of the web development today.
Sure! It's Sciences Po médialab, in Paris.
https://github.com/medialab (linking Github, as it's much more relevant than the actual site).
The tenets of the lab have (more or less) to do with exploring Gabriel Tarde's theories of "Actor-Network" and monads (nothing to do with FP, mind you).
One of the fundamental idea behind this being that everyone now generates traces on the web, and anthropologist/social sciences researchers may use them as a new "terrain" of research.
It was founded by anthropologist and philosopher Bruno Latour, and a group of engineers (who knew each other from school, where they were dabbling with programming for networks/exploration of the web early on).
By network, I mean graphs (math).
Projects usually involves triumvirates of designers (usually specializing in information, sometimes students/researchers themselves), engineers, and politics or social sciences academics. Often being two things at a time.
We have regular hackathon-like sessions called "datascapes" where we explore (sometimes, dormant) data sets, either from the web, or digitized (i.e. scanned historical archives, etc...) to make sense of it, and come up with relevant research questions.
(We also do boring stuff to pay the bills, so that we have enough freedom to work on project we like afterwards).
It was about a decade ago or so. I was finishing high school and contemplating studying graphic design or animation in a renowned school in my hometown (Les Gobelins, Paris). I befriended freshmen who were being sucked up into Flash animation trend and we started working for short-lived startups as Flash animators.
Then I discovered the works of Joshua Davis', Erik Natzke's, Robert Hodgin's (aka flight404) and it was the first epiphany — I started coding. It became a part-time job and a time-consuming intellectual pursuit up till now.
I knew nothing about it, but chose Fashion Design out of curiosity and because it's an interest I could share with my sister, but kept programming everyday. I never regretted it. In some way, it's very much like architecture (technical + philosophical + social impact). I even worked as a fashion designer for a short period right after, but it was not for me.
I learned HTML, CSS and PHP, then AS3, all thanks to the massive amount of literature available. I worked part time, paying part of my school tuition. When I graduated, I used my connections within the fashion industry to work as a Flash dev in a creative agency specialized in luxury brands.
Today I'm a full-stack web dev doing mostly JS, Python and studying Lispy dialects. I currently hold a position in an academic lab, where we blend design, research and engineering to study social sciences-related question within large data sets.
I'm studying math and algorithms to make a transition for the web to other scope of interest.
Some of the assumptions in this article are very ambiguous and makes the reading quite disturbing.
I don't grasp the author's notions of IQ. Maybe it's me misunderstanding the writing, but IQ is more of a normative scale than an infinite scale. You don't push your IQ to 1000. It's not an anime energy level. This makes no sense.
Then there are things like "Right now we've got assortative mating going on at a scale relatively unprecedented in history" (assumption or data-based fact?)...
There's a real gap identified (execution permission instead of output guardrails). The timing concern is valid (we're scaling agent framework way faster than security infrastructure — see Clawdbot-Moltbot). The default-deny + time-boxed permissions + audit logs is a solid model, easy to discuss at high-level with security teams in an org. The "Auth0 for AI Agents" framing is clear and positions it well.
Actually, the audit log piece is really huge. Having a complete execution trace with authorization decisions is invaluable for incident response. That alone might justify adoption even if the blocking mechanism is imperfect.
My concerns and questions:
- Where exactly does this sit? If it's between the agent and tool calls, that's relatively straightforward. If it needs to intercept arbitrary code execution or API calls, that's significantly harder.
- Adding another authorization layer means more setup, more policy configuration, more potential points of failure. Adoption challenge.
- Who defines what's "allowed"? In what format? How granular? Actually expressing "this agent can do X in context Y at time Z" in a way that's both powerful and usable, that's the whole ballgame (IMHO). I have in mind how complex AWS IAM policies got, and those are for relatively static systems. AI agents are dynamic, context-dependent, and probabilistic.
- By the time Reg sees a request to execute, the LLM has already decided. What happens when you block it? Does the agent gracefully handle denials and retry with different approaches?
I'd be interested in seeing real-world policy examples from your design partners. That'll tell you whether you've found the right abstraction layer.
Congratulations for just framing the idea and getting this far. Being very concerned about the current free-wheeling AI expansion with minimal security, I strongly believe this is going in the right direction and would like to know where this leads.