THE PROMPT IS NOT THE PERMISSION: SECURING THE AGENTIC SDLC

Summary from the TLDR InfoSec newsletter

Telling a coding agent what not to do does not stop it, because a malicious line in an issue, changelog, or config file can steer it into reading secrets or leaking private data while still producing a clean pull request. Real limits have to live outside the model, through isolated workspaces, task-scoped identities, short-lived credentials, and network policy. Test those limits directly, since an agent refusing a planted instruction proves nothing about whether the platform would have blocked the action.