---
title: "Security"
url: https://www.grahambrooks.com/tags/security/
---

# Security

- [Letting an agent read your mail: split the reader from the network](https://www.grahambrooks.com/post/letting-an-agent-read-your-mail/index.md) (2026-09-26): An agent that reads your inbox is reading text written by strangers, so whether the model behaves is the wrong question. The useful question is what the process holding that text can do. In the twin's mail reader, the answer is enforced by the OS rather than asked for in a prompt: the one process that can see Mail can't touch the network, and the model that ranks the mail has no tools. Some things still get through, and they're worth naming.
- [A Control Plane for a Personal GitHub Account](https://www.grahambrooks.com/post/automating-github-account-management/index.md) (2026-07-25): Running 120+ personal repositories as a self-sustaining estate: config-as-code, scheduled workflows, a deliberately non-admin GitHub App, and a bounded role for the model.
- [Sandboxing AI Coding Agents: Why Isolation Matters](https://www.grahambrooks.com/post/ai-coding-isolation/index.md) (2026-03-22): The more context and tools an AI coding agent has access to, the better it performs. But more power means more risk. How do we harness the full capability of AI coding assistants while keeping our systems safe? The Problem:…