Note. This is a generalized writeup. All environment-identifying details (addresses, hostnames, accounts, organization) have been removed. It describes how the work was controlled, not the system it was done on.
Context
A small internal engineering environment runs a handful of self-hosted, open-source services (a Git server, a low-code database, a workflow-automation tool, and two internal web apps) on a single Windows host using Docker. The environment is governed by a U.S. defense-contractor security framework (CMMC Level 2): deny-by-default network firewall, host firewall, full-disk encryption at rest, managed-device compliance, and no inbound internet access, strictly LAN-only.
I own the security engineering and change control for this environment. In 2026 I used an AI coding agent as the executor for a complex, multi-phase production change, and kept myself as the controller who scoped, approved, and verified every consequential step.
What the agent did, and what I kept under human control
The largest change was an overnight, roughly seven-phase upgrade and integration of the Git server (version upgrade with a live database migration, reverse-proxy integration, backup-pipeline changes, and auto-generation of compliance evidence). The agent did the mechanical work quickly and consistently. I sequenced the operation so that no step could cause unrecoverable harm without my approval.
The control mechanisms I built around the agent:
- The agent paused for my explicit approval before each phase that touched live data, network exposure, or service availability. Its autonomy was bounded at those points.
- Before any change, a full database dump, a configuration snapshot, and the prior binary and image were preserved as labeled rollback artifacts. Every phase had a tested rename-old-back-and-restart rollback path.
- The operation refused to start until automated checks confirmed all paths, services, dependencies, and connectivity were healthy, so the agent could not begin work on an unsafe baseline.
- After each phase, every service was regression-checked and every endpoint confirmed responding before the agent could proceed or report success. Success was asserted only against observed output.
- Exactly one service publishes a single port. Every other service is reachable only through an internal reverse proxy on an isolated bridge network, so no container can reach the physical LAN directly or bypass the host and firewall boundary.
Security judgment beyond the agent
The same engagement produced a written update-management standard, which is the part I would keep if I had to keep only one thing:
- Mutable tags (
:latest,:stable) are banned in production because they silently ingest whatever upstream last pushed, including a compromised push. I record exact image digests so any change is diffable and reproducible. - Before any update: checksum and signature checks against an independent source, changelog review for unexpected new network behavior, and a deliberate wait period after release, so a compromised push has time to surface before I pull it.
- When a widely used container-vulnerability scanner was itself compromised through its distribution channel (a 2026 supply-chain incident), I suspended adoption of that class of tooling and documented compensating controls instead.
What I took from it
Running an agent against production showed me which controls actually hold up:
- Getting the agent to act was the easy part. The work was bounding its authority: I had to be able to review, approve, and undo every consequential action, and I had to be able to see when it had done the wrong thing correctly.
- An agent's own tools and dependencies are an attack surface. The same supply-chain discipline I apply to container images applies to the tooling we hand autonomous agents.
- Reversibility, pre-flight gating, and verify-before-claim are testable controls, and they get harder to enforce as the agent gets more capable.
Scope and attribution
I scoped, sequenced, approved, and verified this work; the AI agent executed under those controls. The controls and the sequencing are my own work and judgment. Outcomes (all phases passed, all services verified, zero rollback invocations needed) are drawn from the operation's own logs and post-change verification.