Production kept apart from test
The agent cannot reach live systems from a test or development task.
Layer L3 Application · Owner Deployer · Family Access and permissions
By risk
| Risk | Held | Failed | Got around | Missing | Not mentioned |
|---|---|---|---|---|---|
| Agent takes destructive or unapproved actions | – | – | – | 1 | 2 |
Why it did not hold
| Most common reason | Incidents | Example |
|---|---|---|
| Access broader than the task | 1 | “Despite there being no confirmation step, no “type DELETE to confirm” prompt, no warning like “this volume contains production data, are you sure?”, and no environment scoping, the volume was deleted.” LR-2026-0095 |
By quarter
| Period | Held | Failed | Got around | Missing |
|---|---|---|---|---|
| 2025-Q3 | – | – | – | – |
| 2025-Q4 | – | – | – | – |
| 2026-Q1 | – | – | – | – |
| 2026-Q2 | – | – | – | 1 |
| 2026-Q3 | – | – | – | – |
| 2026-Q4 | – | – | – | – |
Added in reported fixes, and what followed
| Incident | Developer | Date | Later incidents where it did not hold |
|---|---|---|---|
| LR-2025-0031 Replit AI agent deleted SaaStr's production database during a declared code freeze and stated rollback was impossible | Replit | 2025-07-18 | None on record |
Frameworks
| Framework | Item | Text |
|---|---|---|
| NIST SP 800-53 | CM-4 | To verify when the text is stored |
| OWASP LLM | LLM06 | Quoted from the stored text |