← back
What if the network was the sandbox? — Remy Guercio, Tailscale
Takeaway
Identity-aware network gateways can enforce agent access while keeping valuable provider credentials outside agent-controlled environments.
Summary
- Guercio decomposes a sandbox into a boundary and permissions, then asks whether authentication and authorization can move to the network layer.
- Tailscale builds identity on WireGuard connections, allowing access rules to use users, groups, and workload tags rather than only addresses and application keys.
- The Aperture AI gateway holds provider credentials centrally and uses the identity of connecting workloads to determine what requests they may make.
- A GitHub Actions runner can join the tailnet through federated OIDC and receive a policy tag, letting an agent use models without placing provider API keys inside its execution environment.
tailscaleidentityagent-security
Original description
Standard sandboxing puts the API key inside the sandbox. The agent has the key, which it can exfiltrate, misuse, or — if it runs long enough — find creative ways to leverage beyond its intended scope. Remy Guercio from Tailscale argues that sandboxing conflates two separate problems: execution isolation and access control. You can fully isolate a runtime and still have the agent holding credentials it can abuse. Their answer is Aperture, an LLM gateway built on Tailscale's WireGuard identity network. Every connection carries verified identity — user, tag, or group — and the agent gets a placeholder instead of a real key. There is nothing to exfiltrate. Every LLM call has to pass through the network layer, so Aperture sees every tool call, bash command, and MCP request without instrumentation inside the container. Internally at Tailscale, bash dominates over structured tool calls — and now they can actually see that. Speaker info: / remyguercio Timestamps: 0:00 - Introduction and the concept of a sandbox 1:15 - Breaking down the components of a sandbox (boundary and permissions) 1:52 - How permissions are typically handled (API keys vs. OIDC) 3:18 - Introducing Tailscale and WireGuard for network-level identity 5:42 - Introduction to Aperture (AI Gateway) 7:28 - Live demo: Viewing usage metrics and logs in Aperture 9:47 - Live demo: Inspecting GitHub Actions PR review bot logs 10:39 - Visibility into tool calls, bash commands, and MCP requests 11:46 - Agent setup and configuration in Aperture 13:59 - Advanced features: Cost controls, quotas, and webhooks 15:35 - Using tsnet to build custom internal identity-aware services 17:03 - Q&A: How to configure permissions (Grants vs. ACLs) 18:46 - Q&A: Network-layer transparency for base URLs 20:25 - Q&A: Permissioning based on users vs. model/provider 21:28 - Q&A: Handling non-tool call agent behaviors (direct code execution)