The Case for Identity-Bound Agents

Conventional agent design often relies on separate machine identities (e.g., a "user-agent" service account). At a 25-year-old quant fund like Two Sigma, this approach failed due to permission drift, licensing conflicts, and systems that reject multiple identities interacting with the same data. Instead of creating a separate identity, Two Sigma runs agents as the user. This leverages existing infrastructure—specifically, per-user Kubernetes namespaces in every region—to ensure the agent inherits the user’s exact permissions, access levels, and security constraints.

Solving for Attribution and Provenance

Running an agent as the user creates an audit challenge: distinguishing human actions from agent actions. Two Sigma solves this by propagating a trace header (similar to a trace ID in distributed systems) through every agent-driven request. By forcing the use of specific HTTP clients and frameworks, they ensure this header is appended at the start and propagated throughout the chain. This provides full provenance, allowing the firm to replay the entire chain of actions to determine if a result originated from a human or an agent.

Securing Web Access via Grounding

Granting agents open internet access introduces exfiltration risks, prompt injection, and licensing exposure. To mitigate this, Two Sigma denies native search and fetch tools within agent harnesses. Instead, they route all web queries through Google’s "web grounding for enterprise," which provides a search index reachable only within their internal network boundary. While this introduces a latency of 6–24 hours for data freshness, the trade-off significantly reduces the attack surface while maintaining the utility of web-based research tools.

Strategic Risk-Return Optimization

By using existing primitives (Kubernetes namespaces, trace headers, and internal search indexes), the firm achieved a high-utility agent ecosystem without building complex, custom security layers. The strategy prioritizes "tethering" agents to the user's identity and network boundary, effectively reducing risk while retaining the value of AI-driven automation. This approach demonstrates that enterprises can leverage frontier AI capabilities by mapping them to existing governance and infrastructure rather than treating them as external, untrusted entities.