HackWednesday visual field guides
Three maps. Better security conversations.
Explore agent trust as an archipelago, incident response as a metro, and the software supply chain as an observatory. Open or download each map for your next team discussion.
AI-generated illustrations with readable explanations below. These conceptual maps are not complete architectures, formal standards, or guarantees of protection.
Map 01
The Agent Trust Archipelago
Every bridge represents a boundary. An agent's goal never grants it permission to cross.
Read the map
- Identity: give each agent an attributable identity, not a shared administrator account.
- Scope: limit resources and actions to the assigned job.
- Sandbox: isolate execution and restrict network destinations.
- Tool gate: enforce authorization outside the model before every tool action. External text is evidence, not authority.
- Audit trail: record actions and outcomes without routinely logging secrets.
- Stop and recover: test cancellation, credential revocation, and restoration.
Keep in mind: The islands organize controls, not execution order. Identity, authorization, isolation, and logging must continue throughout the job. The red path marks an input boundary, not permission to run instructions.
Ask your team: Which bridge could an agent cross today without an independent permission check?
Map 02
The Incident Response Metro
Follow the signals, contain the impact, and keep evidence and communication moving throughout the response.
Read the map
- Detect: collect signals from identities, endpoints, workloads, and agent actions.
- Validate: establish scope and confidence while recording uncertainty.
- Contain: restrict compromised access with attention to service and safety impacts.
- Eradicate: remove persistence and address the underlying cause.
- Recover: restore from trusted sources and verify service integrity.
- Learn: improve detections, runbooks, and ownership using the evidence.
Keep in mind: This is a discussion aid, not a formal standard or a rigid sequence. Preparation comes before an incident; phases can overlap or repeat. Preserve evidence and communicate throughout, following your organization's response plan.
Ask your team: Can your team revoke an agent's credentials while preserving the evidence needed to investigate?
Map 03
The Supply Chain Observatory
Review the journey from source to runtime. A trusted handoff needs evidence, not just a green checkmark.
Read the map
- Source review: protect branches and review security-sensitive changes.
- Dependency checks: review origins, versions, advisories, and dependency changes.
- Isolated build: use constrained build workers and short-lived credentials.
- Provenance: verify artifact identity, signatures, and build attestations against trusted policy.
- Deploy approval: bind authorization to the exact artifact and environment.
- Runtime signals: monitor changes and unexpected behavior after release.
Keep in mind: A valid signature can establish origin and integrity relative to a trusted key; it does not establish that software is harmless. Scanners and provenance are complementary controls, not guarantees.
Ask your team: Could you identify the source and build process behind the exact artifact running in production?
Continue with the castle and ship defense blueprints or the Wednesday Brief.