Four Vendors Put the Control at a Choke Point. One Engineer Calls It Theater.

Docker names three surfaces where an agent can be constrained: “network access, the filesystem, and the tools an agent can reach.” NVIDIA reports a “55% reduction” in repeated login events after routing access to its internal developer platforms through one federated session record. Cloudflare describes a remediation pipeline where “if one of those checks fails, the workflow stops before the proposal reaches customer review.” A design essay in UX Collective argues that the approval surface is “the policy layer of the product.”

Four publications in the same month, from a container vendor, a chip vendor, an edge platform and a design essay, arriving at the same architectural instinct: stop asking the agent to behave, and put the constraint somewhere the agent cannot argue with.

Jake Gold, who builds AI infrastructure at clor.com, published in the same month a sentence that dismantles the comfortable version of that instinct: “An agent that never sees my SSH private key but gets a root shell can still rm -rf the production system.”

Both are right. The interesting work is figuring out when.

What the convergence actually says

Docker’s framing of YOLO mode is worth quoting because it is the clearest statement of the position, and worth attributing because Docker sells the product that implements it. Eric Jia and Srini Sekaran write: “For one developer on a sandboxed laptop, YOLO mode is a personal choice. Across a team, it becomes a policy question… The picture that works at scale is one where the safe path is the default.”

That is a vendor’s argument, and it is also a correct one. The escalation from personal choice to policy question is the transition the post is written for, and it is the one I keep meeting in engineering organizations. Docker cites Stack Overflow’s 2025 Developer Survey for the adoption number behind it: “84% of developers said they use or plan to use AI tools in their workflow, up from 76% a year earlier.” That figure is second-hand, reported by Docker rather than measured by it, and it is doing rhetorical work in a post that sells governance tooling. Take it as directional.

The three surfaces Docker names are the useful part. Network, filesystem, tools. Each is a place where a constraint can be expressed once, by a platform team, and applied to every agent that runs. None of them requires the agent to cooperate. We have already argued the layered version of this in the containment stack and in the four-layer review, so the layers are not the news here.

Cloudflare’s contribution is the shape of a workflow that stops. Blake Darché describes a vulnerability discovery and remediation pipeline where automated checks gate what reaches a human, and where on proposed patches “you decide whether they are implemented.” That is a choke point with a specific property: the agent produces, the pipeline evaluates, and the pipeline can refuse. The agent has no path around the refusal because the refusal lives in the pipeline, not in the agent’s instructions.

The dissent

Gold’s post carries no statistics at all, and it is more useful for that. His position is that credential scoping is often solving a problem adjacent to the one you have. You can remove every secret from an agent’s environment, congratulate yourself on the blast radius, and still have handed it enough operational reach to end the company.

His reasoning for granting production access is worth reading exactly as written: “I give agents production access for the same reason I give access to inexperienced teammates.” That is a claim about proportionality. An inexperienced teammate can also drop a table. You manage that with reversibility, review and observability, not by pretending the access does not exist.

The version of the choke-point argument that fails his test looks like this. A team scopes the agent’s credentials tightly, removes the SSH keys, injects short-lived tokens, and then runs the agent as root inside a container that has the production database mounted. Every credential control is real. Every one of them sits beside the agent’s actual capability rather than underneath it.

The test: below or beside

A choke point counts when it sits below the agent’s operational reach. It does not count when it sits beside it.

Below means the agent’s action passes through the control on its way to having any effect. The filesystem boundary is below: the agent writes, the kernel decides. Cloudflare’s gate is below: the proposal is produced, then the workflow stops, and stopping is not something the proposal can veto. NVIDIA’s session record is below in a specific dimension, which I will come back to.

Beside means the control governs one route to an effect while another route remains open. Credential scoping is beside whenever the shell the agent already holds can reach the target without those credentials. A tool allowlist is beside if the allowlist includes a general-purpose shell. An approval prompt is beside if the agent can accomplish the same thing through an action that does not trigger the prompt.

Run the test on your own setup by naming the worst outcome first, then asking which control physically intervenes on the path to it. If the answer is a control that governs a different path, you have decorated the wrong door.

Identity is the part the containment essays leave open

NVIDIA’s post from Bhagat Khemchandani and Rohan Somvanshi is about a narrower problem than containment, and it fills a hole the containment essays leave open. Their subject is carrying the human identity behind an agent request across federated Kubernetes and AI platforms spanning AWS and OCI clusters. One session record, propagated, revocable everywhere at once.

The operational detail worth stealing: “Strip inbound identity headers before injecting trusted ones.” An identity claim that arrives from outside your trust boundary is an assertion, not a fact. If you inject trusted headers without stripping first, you have built a system where anyone upstream can name themselves.

The reported outcome is a “55% reduction” in repeated login events across their internal developer platforms. That is a developer-experience number, not a security number, and it is NVIDIA reporting on NVIDIA. What it demonstrates is that centralising the session record did not cost the friction people expect from it.

This is a different problem from anchoring an agent’s own identity, which we covered in durable agent identity. Here the question is whose authority the agent is borrowing, and whether you can withdraw it in one place.

Counting approvals is the wrong instrument

Aurélie Radom’s essay in UX Collective (her bio lists Metalab and Frog as past work) makes a point that is easy to lose once approval becomes a metric: “Human involvement should not be measured by how many times a person has to click approve. What matters is whether people remain in control of the decisions that depend on judgment, context or preference.”

Teams that measure approval count optimise for the wrong thing in both directions. They either add prompts until the human clicks through them without reading, or they remove prompts to hit a velocity target and lose the decisions that mattered. Radom’s framing, “this is the policy layer of the product,” puts the design of that surface where it belongs, next to the people who own the product rather than only in the security review.

Her four-question checklist for handing work to an agent is the most portable artefact in any of these five publications:

“What can the agent do without asking? / When should it request confirmation? / Which actions should be reversible? / Which decisions should always remain with a person?”

The third question is the one that resolves Gold’s objection. Reversibility is a property of the effect, not of the credential. It survives a root shell.

Do this now

Take one agent that runs against a production system. Write down the single worst thing it could do. Then answer two questions in writing.

First, which control physically sits on the path between the agent and that outcome? Name the mechanism, not the policy. “The agent is not supposed to” is not a mechanism. If the only answer you have is credential scoping, and the agent holds a shell on a host that can reach the target, your control is beside, not below.

Second, if that outcome happened at 3am, how long until it is reversed, and by whom? Radom’s reversibility question is cheaper to answer than a containment rebuild, and it is the control that holds when the choke point does not.

Do both for one agent this week. The answer will tell you whether to keep building the choke point or to start building the undo.

This analysis synthesizes What is YOLO mode? (Docker, September 2026), I trust my coding agents with production secrets now (Jake Gold, September 2026), How to carry user identity across federated Kubernetes and AI platforms (NVIDIA, September 2026), Vulnerability Discovery and Remediation (Cloudflare, September 2026), and When the canvas starts acting, who’s really in control? (UX Collective, September 2026).

Victorino Group helps engineering organizations decide which agent controls sit below operational reach and which only look like they do. Let’s talk.