--- title: Tethered: Our Agents Are Us — Shu Fang, Two Sigma description: A Two Sigma engineer describes how the quant fund lets every employee run cloud-based coding agents under their own full user identity rather than a separate... canonical: https://daily.dev/posts/tethered-our-agents-are-us-shu-fang-two-sigma-vu1vn7y1n twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Tethered: Our Agents Are Us — Shu Fang, Two Sigma | daily.dev og:description: A Two Sigma engineer describes how the quant fund lets every employee run cloud-based coding agents under their own full user identity rather than a separate... og:url: https://daily.dev/posts/tethered-our-agents-are-us-shu-fang-two-sigma-vu1vn7y1n og:image: https://api.daily.dev/og/posts/vu1vN7Y1N.png og:image:alt: Tethered: Our Agents Are Us — Shu Fang, Two Sigma og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Tethered: Our Agents Are Us — Shu Fang, Two Sigma **[AI Engineer](https://daily.dev/sources/aidotengineer)** · 21 min read · 0 upvotes · 0 comments ## Summary A Two Sigma engineer describes how the quant fund lets every employee run cloud-based coding agents under their own full user identity rather than a separate machine identity, avoiding permission-sync headaches and licensing duplication. To manage the resulting risks, they attribute agent versus human actions using a propagated trace-ID header (rather than a separate agent identity), and they block native web search/fetch tools in agent harnesses like Claude Code, redirecting all web access through Google's 'Web Grounding for Enterprise' index (cached within a VPC, fresh within 6-24 hours) to eliminate external egress and reduce prompt-injection/exfiltration risk. The talk closes with Q&A on local LLMs, session data privacy, and internal agent-building processes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Two Sigma let coding agents access the web safely without exposing them to prompt injection or data exfiltration risk? Native web search and fetch tools in agent harnesses like Claude Code are denied outright, and all web access is redirected through Google's Web Grounding for Enterprise, a cached search/fetch index that runs inside the company's own VPC and network boundary. Data freshness lags real time by about 6 to 24 hours depending on the site, but this removes external egress as an attack vector while still giving agents usable web access. _Teams weighing agent web-access tradeoffs can track enterprise AI security patterns like this on daily.dev._ ### Should AI agents run under a separate machine identity or under the human user's own identity in an enterprise? Running agents under a dedicated machine identity tends to collapse in practice because permissions drift out of sync, software licensing has to be duplicated, and some systems like Google Workspace do not support multiple identities touching the same data. Two Sigma instead runs agents as the exact same identity as the human user, inheriting all their existing access and Kubernetes namespace infrastructure, then differentiates human versus agent actions using a propagated trace-ID header instead of a separate identity. _Anyone deciding how to provision agent identity at scale can compare approaches like this on daily.dev._ ## Similar posts on daily.dev - [IEEE Cloud Summit 2026: The Tunnels No One Mapped](https://daily.dev/posts/ieee-cloud-summit-2026-the-tunnels-no-one-mapped-livjy4s3b) · GitGuardian · 1 upvotes · 0 comments - [Prevent agentic identity theft](https://daily.dev/posts/prevent-agentic-identity-theft-exphjl34y) · Stack Overflow Blog · 1 upvotes · 0 comments --- Tags: [#cloud](https://daily.dev/tags/cloud), [#kubernetes](https://daily.dev/tags/kubernetes), [#ai-agents](https://daily.dev/tags/ai-agents), [#observability](https://daily.dev/tags/observability), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/tethered-our-agents-are-us-shu-fang-two-sigma-vu1vn7y1n) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Tethered: Our Agents Are Us — Shu Fang, Two Sigma","url":"https://daily.dev/posts/tethered-our-agents-are-us-shu-fang-two-sigma-vu1vn7y1n","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tethered-our-agents-are-us-shu-fang-two-sigma-vu1vn7y1n"},"datePublished":"2026-09-03T14:31:45.046Z","dateModified":"2026-09-03T14:32:08.181Z","description":"A Two Sigma engineer describes how the quant fund lets every employee run cloud-based coding agents under their own full user identity rather than a separate...","image":"https://i.ytimg.com/vi/wCIYViPd4SU/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/wCIYViPd4SU/sddefault.jpg","isAccessibleForFree":true,"articleSection":"AI Engineer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AI Engineer","logo":"https://media.daily.dev/image/upload/s--u5PucxNT--/f_auto/v1724338940/logos/aidotengineer","url":"https://daily.dev/sources/aidotengineer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tethered-our-agents-are-us-shu-fang-two-sigma-vu1vn7y1n","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cloud,kubernetes,ai-agents,observability,prompt-injection","timeRequired":"PT21M","video":{"@type":"VideoObject","name":"Tethered: Our Agents Are Us — Shu Fang, Two Sigma","description":"A Two Sigma engineer describes how the quant fund lets every employee run cloud-based coding agents under their own full user identity rather than a separate...","thumbnailUrl":"https://i.ytimg.com/vi/wCIYViPd4SU/sddefault.jpg","uploadDate":"2026-09-03T14:31:45.046Z","duration":"PT21M","url":"https://api.daily.dev/r/vu1vN7Y1N","embedUrl":"https://www.youtube.com/embed/wCIYViPd4SU"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AI Engineer","item":"https://daily.dev/sources/aidotengineer"},{"@type":"ListItem","position":3,"name":"Tethered: Our Agents Are Us — Shu Fang, Two Sigma"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tethered-our-agents-are-us-shu-fang-two-sigma-vu1vn7y1n#faq","mainEntity":[{"@type":"Question","name":"How does Two Sigma let coding agents access the web safely without exposing them to prompt injection or data exfiltration risk?","acceptedAnswer":{"@type":"Answer","text":"Native web search and fetch tools in agent harnesses like Claude Code are denied outright, and all web access is redirected through Google's Web Grounding for Enterprise, a cached search/fetch index that runs inside the company's own VPC and network boundary. Data freshness lags real time by about 6 to 24 hours depending on the site, but this removes external egress as an attack vector while still giving agents usable web access. Teams weighing agent web-access tradeoffs can track enterprise AI security patterns like this on daily.dev."}},{"@type":"Question","name":"Should AI agents run under a separate machine identity or under the human user's own identity in an enterprise?","acceptedAnswer":{"@type":"Answer","text":"Running agents under a dedicated machine identity tends to collapse in practice because permissions drift out of sync, software licensing has to be duplicated, and some systems like Google Workspace do not support multiple identities touching the same data. Two Sigma instead runs agents as the exact same identity as the human user, inheriting all their existing access and Kubernetes namespace infrastructure, then differentiates human versus agent actions using a propagated trace-ID header instead of a separate identity. Anyone deciding how to provision agent identity at scale can compare approaches like this on daily.dev."}}]} ```