RACE Programming
Case Study · Agent infrastructure

The agent cannot leak what it never had

AI agents are only useful with access: repositories, clouds, SaaS APIs, servers. That makes an agent the most credential-exposed worker in the building. This platform gives it all of that access while making sure it never holds a real secret, by moving the credential boundary from the filesystem to the network.

The challenge

Isolation protects the host, not the secret

The base open-source platform already does the obvious thing well. Every agent runs in its own locked-down container: non-root, allowlisted mounts, no direct route to the internet. That contains what the agent can reach and what it can break.

It does nothing for a token that is already inside. Once an agent holds a real credential, prompt injection can talk it into revealing the value, a careless commit can publish it, and a debug log can persist it. The container boundary never registers a failure, because from its point of view nothing escaped. The credential did.

The solution

Substitutes inside, real credentials at the edge

The agent receives a format-preserving fake: the same shape as the real token, with randomized content. All agent traffic passes through a host-side proxy that swaps the substitute for the real credential at the network edge, and only for approved destinations. Real secrets are encrypted at rest outside any path a container can mount.

  • A leaked substitute is a non-event. It authenticates nowhere and can be invalidated without rotating the real credential. Yet it still looks like a secret, so scanning tooling and human reviewers catch it. Detection without damage.
  • Refresh never enters the container. Expiry and rotation are handled host-side, and refresh tokens never cross the boundary. The agent can be shielded from ever seeing an auth failure at all.
  • SSH is isolated, not substituted. The host authenticates and hands over a pre-authenticated connection socket, so passwords, keys, and passphrases never enter the container while ordinary ssh, scp, and rsync still work. Agent forwarding is hard-disabled, host keys pinned.
  • Scoped by design. Credentials belong to specific agent groups, cross-group use requires an explicit bilateral grant, and every swap is auditable through a token-redacting traffic log.
The RACE pattern

Capability, never authority, enforced by mechanism

RACE Programming draws one line consistently: the agent executes, and a human keeps authority. This platform draws the same line one layer down, in the network, where it is not a policy the agent could be talked out of but a mechanism it cannot reach around.

The security property that matters most here is a testing property. Because substitutes do not need hiding, the failure mode becomes observable and harmless, and secret-scanning tooling becomes an ally instead of something to work around. That is the same reasoning behind gating a change with an automated Definition of Done rather than trusting a careful review: make the failure visible and cheap, then you can move fast on top of it.

The result

Running on our own delivery

The platform runs inside First Line Software today, with Slack-integrated agents doing real project delivery and marketing work on it, and it is offered to clients as a foundation for their own agent deployments. Out of the box the proxy handles auth for on the order of seventy SaaS and cloud providers, with a broker tier for enterprise secret vaults. The security-critical modules carry roughly a one-to-one test-to-source ratio, and the credential swap path is covered by live end-to-end tests rather than mocks.

This is an internal platform, not a client delivery. Built in the shape of RACE Programming, as a fork of a community-audited isolation model with the enterprise layer added on top.

More case studies → · Read the framework →

FAQ

Frequently asked questions

What was built in this engagement?
A secure runtime for autonomous AI agents, built as a hardened fork of an open-source agent platform. The base platform already isolates each agent in a locked-down container: non-root, allowlisted mounts, no direct internet route. The addition is credential isolation: the agent never possesses a real credential of any kind. It receives format-preserving substitutes, and a host-side proxy swaps them for the real thing at the network edge, only for approved destinations.
Why is container isolation not enough?
Because isolation protects the host from the agent, not the credential from exposure. Once a real token is inside the container, prompt injection, a careless commit, or a log line can carry it out, and the container boundary never sees a problem. The fix is to move the credential boundary from the filesystem to the network, so there is no real secret inside to leak in the first place.
What happens if a substitute token leaks?
Nothing, and that is the point. A substitute authenticates nowhere and can be invalidated without rotating the real credential. But it still looks like a secret, so scanners and reviewers catch it in code, docs, or chat. You get detection without damage, which turns a security failure mode into an observable, harmless event. It is a testability property applied to security.
How is SSH handled, since a token swap is impossible there?
By isolating the connection instead of substituting a secret. The host authenticates and hands the agent a pre-authenticated connection socket, so passwords, private keys, and passphrases never enter the container in any form, while plain ssh, scp, and rsync still work normally. Agent forwarding is hard-disabled and host keys are pinned. HTTP tokens can be swapped mid-request and SSH cannot, so it needed a different mechanism: the design is per protocol, not one trick stretched thin.
How does this relate to RACE Programming?
It is the same stance the framework takes on delivery, enforced at the network layer: the agent gets capability, never authority. In a RACE delivery the Silicon Software Engineer executes while humans own acceptance. Here the agent can reach every system it needs to do real work, and still holds nothing it could give away. Scoping is explicit, cross-group use requires a bilateral grant, and every swap is auditable, which is the same instinct as gating a change before a Pit Stop rather than trusting it.