Back
60/65
Lesson 60
10 min
Security Deep Dive
Three-layer defense with DCG, SLB, and CAAM for safe agent autonomy
Ready to level up?
Mark complete to track your learning progress.
Three-layer defense with DCG, SLB, and CAAM for safe agent autonomy
Mark complete to track your learning progress.
Understand the three-layer security model that makes agent autonomy safe — DCG blocks dangerous commands, SLB gates risky operations behind peer review, and CAAM prevents credential exposure.
Single safety measures fail. The flywheel uses three independent layers so that no single point of failure can let a dangerous operation through.
Block destructive commands mechanically
Two-person rule for risky operations
Credential isolation and rotation
Each layer catches what others miss
DCG is a Claude Code hook that runs before every command execution. It uses ast-grep internally for structural pattern matching, operating at sub-millisecond latency — agents don't even notice it's there.
# DCG blocks destructive commands automatically# Agent tries: rm -rf /# → BLOCKED: filesystem.recursive_delete# DCG understands command STRUCTURE, not just stringsdcg test "rm -rf /" --explain# → BLOCKED: Root path deletiondcg test "rm -rf /tmp/build" --explain# → ALLOWED: Scoped to /tmp (not root)dcg test "git push --force origin main" --explain# → BLOCKED: Force push to protected branchdcg test "git push --force origin feature-x" --explain# → ALLOWED: Force push to feature branch# DCG packs (rule bundles)dcg packs --enabled# → git-safety, filesystem-safety, database-safety, k8s-safety# Health checkdcg doctor --format json
rm -rf /tmp/build is scoped while rm -rf / is destructive.For commands that are sometimes needed but always dangerous, SLB enforces a two-person rule. One agent creates a launch request, and a human (or second agent) must approve before execution.
# Initialize SLB in a projectslb init# Agent 1 wants to force-push (DCG would normally block)slb request "git push --force origin main" --reason "Rewrite history on my feature branch"# → Launch request created: slb-a7f3# Agent 1 sees:# ⚠️ CRITICAL: Requires approval before execution# Human reviews and approvesslb approve slb-a7f3# Now the command can executeslb execute slb-a7f3# Policies for automated workflowsslb config set policy auto_reject # Reject all by defaultslb config set policy auto_approve_warn # Auto-approve with warning# Watch agent activity in real-timeslb watch --session-id my-agent# → Live stream of all commands the agent tries
CAAM manages multiple API provider accounts with automatic rotation on rate limits. This prevents a single compromised or rate-limited key from stopping all agents.
# List all configured accountscaam list# → claude-1 (active, 847/1000 requests)# → claude-2 (standby, 12/1000 requests)# → codex-1 (active, 230/500 requests)# Switch active accountcaam switch claude-2# Auto-rotate when rate limitedcaam config set auto-rotate truecaam config set cooldown-minutes 15# Add a new accountcaam add claude-3 --provider anthropic --key-file ~/.keys/claude3# Check rate limit statuscaam status --all# → Shows usage, remaining quota, cooldown timers# In agent swarms, each agent gets a different account# Agent 1 → claude-1# Agent 2 → claude-2# Agent 3 → codex-1# No single account gets overwhelmed
When an agent runs a command, it passes through each security layer in sequence. Here is the decision flow:
# Real scenario: Agent needs to drop and recreate a test database# Step 1: Agent tries "DROP DATABASE test_db"# → DCG: BLOCKED (sql.destructive_ddl)# Step 2: Agent creates SLB requestslb request "DROP DATABASE test_db" --reason "Recreate the throwaway test DB"# → slb-b2e9 created, awaiting approval# Step 3: Human reviews, sees it's a test DB, approvesslb approve slb-b2e9# Step 4: Command executes safely through SLBslb execute slb-b2e9# Step 5: Agent continues with API calls via CAAM# → CAAM routes to claude-2 (claude-1 is cooling down)
All three layers produce audit logs, giving you a complete picture of every security decision made during agent operation.
# DCG logs every block decisiondcg stats --days 1# → Blocked/allowed/bypassed counts and the rules that fired# SLB tracks every request, approval, and executionslb history --json# → Full history with who requested, who approved, when# CAAM logs account switches and rate limit eventscaam history --limit 50# → Shows rotation events, usage spikes, cooldown periods# Combined: full picture of agent safety# "At 14:32, agent-3 tried 'rm -rf /data',# DCG blocked it, no SLB request created.# At 14:35, agent-1 hit rate limit on claude-1,# CAAM rotated to claude-2 in 12ms."
Three independent layers, each catching what the others miss. DCG for speed, SLB for judgment, CAAM for resource protection. Together they make it safe to give agents real autonomy.