AI Engineer Europe 2026
What if the network was the sandbox?
Read the talk
What if the network was the sandbox?
An agent can run inside a container while holding the credential that grants its access. Moving authorization to an identity-aware network changes where that control lives.
From a talk by Remy Guercio
Before you start: Basic familiarity with API credentials, HTTP requests, containers, and coding agents will help; tailnets and network identity are explained as they appear.
A boundary needs permissions
What makes a sandbox useful: the box, or what the agent is allowed to do from inside it? The familiar discussion starts with VMs versus containers, then asks whether the agent belongs inside or outside that boundary. Remy Guercio starts with two simpler components: a boundary separating inside from outside, and permissions, including identity, that determine what can happen across it. Without permissions, the sandbox has no toys: it isolates something without giving it useful access.
The usual ways of granting that access put credentials inside the environment being constrained.
| Access mechanism | What the agent receives | The unresolved problem |
|---|---|---|
| API key | A credential granting provider access | Possession of the key does not, by itself, express the full authorization policy |
| OAuth or OIDC login | Access associated with an authenticated account | The account session still lives with the agent |
Guercio characterizes API-key billing as the full-price route and account-based access as potentially more cost-effective. But the architectural issue is the same. Authentication establishes an identity; authorization decides what that identity may do. Handing an agent a key does not settle that distinction, and even synthetic keys can become objects a long-running agent tries to reuse or manipulate.
An OpenClaw instance running elsewhere with a logged-in account makes the problem concrete. The agent is in a box, but the thing granting its access is in the box too. That leads to the central question: can the network carry the permission boundary instead?
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Connections carry identity
WireGuard gives network nodes cryptographic keys. Tailscale builds an identity layer on top, connecting devices in a private network called a tailnet. Those devices can be containers, GPU servers, laptops, or phones; the useful abstraction is a connection between identified participants, rather than a particular kind of compute environment.
The identity can describe either a person or a workload:
- Users: A connection from a logged-in laptop can be associated with its user.
- Groups: SCIM-synchronized membership can identify the user as belonging to an engineering organization or another team.
- Tags: A GitHub Actions workload can carry a tag identifying it as a particular project's PR review bot.
That information supports two decisions. Network policy can prevent an unauthorized connection from happening at all. If the connection is permitted, the receiving application can also obtain the caller's identity and use it for application-level authorization. The application no longer has to start with an IP address and ask for a separate API key just to learn who is calling.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Keep provider credentials at the gateway
Aperture applies this identity model to an LLM gateway. Like a conventional gateway, it stores provider credentials and forwards requests to upstream services. Guercio names Anthropic, OpenAI, Google's Gemini offerings, Vertex, and Bedrock. The difference is that Aperture is itself a tailnet node, so it can identify the clients connecting to it without issuing each client another provider credential.
For a PR review agent running in GitHub Actions, the authorization path is:
- The runner starts and uses GitHub's federated OIDC identity to obtain tailnet access through workload identity federation.
- The runner receives a workload tag on the tailnet.
- It connects to Aperture, which can resolve that identity.
- Aperture's rules determine what the tagged workload may access through the gateway.
The provider key remains on Aperture. The sandbox has no provider API credential to leak, share, or take to another endpoint. It still has network identity and the credentials needed for that identity; the removed secret is the upstream provider key. The agent can request access without possessing the provider credential that fulfills the request.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
From a user identity to a request body
In the live dashboard, Guercio switches Aperture to light mode and opens his own usage. His laptop is logged into the corporate tailnet, so Aperture recognizes him as a user. That identity connects the overview—tokens, models, and spending—to the individual requests that produced it.
Opening a request exposes its headers, request body, and response body, including the context Claude Code sends before the user's short instruction. Guercio initially describes the request as asking for a greeting, then corrects himself: it asked for a ten-word story, about a cat sitting on a mat and then vanishing. The distinction matters because the visible user prompt is only a small part of what the client sends.
The session view groups the activity into two requests: a Haiku summary request and the story request. Guercio reports that the initial story request cost $0.20 with Claude Code's supplied context. That is the displayed session's cost, not a price for ten-word stories independent of their surrounding context.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Follow a PR review bot through the gateway
The same inspection works for a workload. Guercio opens a small PR review check that runs on every PR update. Instead of his user identity, its activity is attributed to a dogfood tag, with a view covering the previous 30 days. Guercio reports a displayed bot request costing $0.04 and running three commands together. Drilling into it exposes the Bash commands involved.
The extraction happens at the LLM gateway, outside the container and outside the agent harness. In the session's tool-call view, Guercio follows an MCP request to update the code review, Bash and grep activity, and another update to the review comment. The inspected frame also shows Read among the listed tools. This is visibility into tool calls represented in model traffic routed through Aperture, not a record of every local process or unrelated network request.
That placement also changes revocation. If access through the gateway is cut off, the sandbox cannot rescue the request by taking its provider key to another endpoint: it never had that key. The control does not depend on the agent accepting an instruction to stop or on a logging hook inside its own harness.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
A placeholder key, then a failed word count
The client configuration is deliberately small. In the agent sandbox script, Claude Code runs in API-key mode, receives a literal - as its placeholder key, and uses Aperture's endpoint as its base URL. The dash satisfies the client's expectation that the key field contain something; it is not what authorizes the request. Guercio then shows the same arrangement in his actual settings.json, names Codex and Gemini CLI as other supported clients, and starts a live ten-word-story request.
While the request runs, he observes that the same prompt has shifted from stories about robots to dogs to cats over roughly three weeks. The live cat story introduces a more immediate problem: an audience member counts only nine words. Guercio identifies the model as Opus 4.6 and jokes about its one-million-token context capacity while it misses this small constraint. Context capacity is not the amount of context used by this request. The correction adds finally to the ending.
A word-count failure is funny in a demo and consequential in a pipeline. A PR review bot may depend on a response having a particular structure; when that structure changes, the workflow can break far from the interactive session that would make the cause obvious. Back in Aperture, the session now contains three requests: the summary, the initial context-bearing story request, and the follow-up asking whether the answer was correct. The request and response bodies preserve both the failure and the model's acknowledgment that it supplied nine words.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Shared budgets and gateway hooks
A shared gateway can apply spending controls across providers. Guercio's example is a single $1,000 allowance whose owner can choose how to distribute usage, rather than a separate $1,000 allocation at every provider. The budget follows the access policy through the gateway instead of being fragmented across upstream accounts.
Aperture also offers webhooks that send tool-call information to a third party. Placing the integration in the gateway means routed interactions can trigger it without depending on a cooperative hook inside the agent. Guercio connects that centralized path to reliable hook invocation; it does not establish unconditional delivery to an external receiver. A smaller quota example—$5 per day—shows how the same gateway can bound experimentation. Provider coverage depends on support for the relevant interfaces.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Build the same identity boundary into a Go service
Aperture is one application of these primitives. Guercio describes it as available on Tailscale's free plan at the time of the talk. Its underlying building block is the open-source tsnet library, which lets a Go program become a tailnet node and read the identity of incoming connections. An internal MCP server or API endpoint can use that identity without becoming publicly reachable or requiring a separate OAuth integration for its callers.
For an internal service, the essential operation is to resolve the requester before acting on the request. This Go example uses the documented tsnet.Server and LocalClient.WhoIs interfaces to return the connecting node and, when present, its user identity. It illustrates the public API rather than reproducing a code listing from the recording.
go
package main
import (
"encoding/json"
"log"
"net/http"
"tailscale.com/tsnet"
)
func main() {
node := &tsnet.Server{Hostname: "identity-demo"}
defer node.Close()
listener, err := node.Listen("tcp", ":80")
if err != nil {
log.Fatal(err)
}
client, err := node.LocalClient()
if err != nil {
log.Fatal(err)
}
handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
identity, err := client.WhoIs(r.Context(), r.RemoteAddr)
if err != nil {
http.Error(w, "identity lookup failed", http.StatusForbidden)
return
}
result := map[string]string{"node": identity.Node.Name}
if identity.UserProfile != nil {
result["user"] = identity.UserProfile.LoginName
}
w.Header().Set("Content-Type", "application/json")
if err := json.NewEncoder(w).Encode(result); err != nil {
log.Printf("write response: %v", err)
}
})
log.Fatal(http.Serve(listener, handler))
}
A service proxying MCP operations could use the resolved identity when authorizing or constructing the downstream operation. Knowing the caller is the starting point; the service must still decide which operations that caller may perform.
Aperture's own design constraint was to use those public building blocks. It could be built on top of Tailscale, but could not depend on private Tailscale API endpoints. That makes the architecture reusable: another application can join the network, identify callers, and apply its own policy without needing Aperture's internal implementation.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Configure permissions in the UI or in policy
The first audience question asks how to configure permissions, particularly whether some tool calls can be allowed and others denied. Guercio shows two configuration paths. In Aperture's Grants editor, administrators select who a grant applies to and configure categories such as model access, quotas, MCP access, hooks, and roles. Aperture also contains an MCP server/proxy. Group selection in that editor is described as forthcoming in the demonstrated version.
The declarative path uses the main Tailscale policy file. Application capabilities attach application-specific metadata to identity, backed by the Tailscale control plane. The receiving application can therefore get more than a user or tag: it can receive policy data relevant to its own authorization decisions. JSON configuration and an API let teams manage this through GitOps instead of making every change in the visual editor.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Why configure a base URL explicitly?
Another audience member asks whether Tailscale could intercept requests to Claude Code's default destination and substitute Aperture automatically. Guercio says transparent interception was discussed and is technically possible, but it is not the chosen approach.
The tradeoff is predictability. Explicitly setting a base URL makes the gateway part of the client's visible configuration. Hidden interception can break behavior or become confusing as underlying systems change. The intended experience pairs easy LLM access for developers with usable controls and tool-call visibility for IT and security administrators, without concealing where requests go.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Model permissions are not yet arbitrary tool permissions
Asked directly about role-based access to individual tools, Guercio distinguishes the implemented controls from work underway. At the time of the demonstration, model, provider, and quota permissions are available; finer tool-specific permissions are still being developed. Group identity, including groups defined through a SCIM provider, supplies the basis for assigning access.
The budget examples span a larger team allowance and smaller individual allowances, or unrestricted use of internal GPU endpoints alongside a capped Opus 4.6 allowance. Guercio calls the team/individual combination a union but does not specify its enforcement algorithm, so those allowances should not be read as automatically adding together.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Generated code exposes the harder boundary
The final question pushes beyond structured tool calls. If an agent writes and executes code, that code can make network requests whose meaning is harder to recover than a named MCP operation. Guercio agrees that permissioning becomes more complicated. This was a reason to observe the LLM layer rather than build only an MCP proxy: an MCP-only view would miss much of the activity that coding agents express through other mechanisms.
Skills and generated code still commonly involve commands represented in the model interaction, making those commands available for inspection. But an agent could write code, obfuscate it, and then execute it. Seeing the outer command does not automatically reveal everything that program will do. Guercio acknowledges that complication rather than presenting command visibility as complete semantic understanding.
For many teams, discovery comes before blocking: they first want to know whether people are using MCP tools, Bash, or something else. Guercio says Bash dominates usage in Tailscale's internal instance, distinct from the demo instance on screen. The gateway makes those command-bearing interactions inspectable.
Guardrails that reject dangerous commands, such as rm -rf /, are described as future additions. The substantive boundary is therefore between observing an operation and enforcing its permitted effects. Moving credentials and policy outside the agent gives an independent place to authorize, record, and revoke model access. Understanding arbitrary generated code remains harder, and the visibility applies to the particular agents whose model traffic is routed through Aperture.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Resources
From the talk
Explains Aperture's identity lookup, model routing, provider authentication, and session telemetry.
Go examples for joining a tailnet, serving requests, and looking up the identity of incoming connections.
Configure trust for cloud workload identities, including GitHub Actions, and map them to permitted tags and scopes.
The model's launch announcement, including its initial one-million-token context beta and launch pricing.
Further reading
An early project account explaining centralized provider keys, identity-aware access, and usage visibility.
Updates since the talk
Current configuration reference: all matching quota buckets must have positive balances and are charged together. Also covers current commercial conditions, providers and hooks.
Later documentation describes additive grants, group identities, and MCP capability permissions; this is distinct from the tool-specific permissions still under development in the recording.
Read the complete timestamped transcript
- 0:00
[upbeat music] Yeah.
- 0:15
Hi, everybody. Uh [laughs] thanks for joining. I know we're a little late starting, so, um, yeah, appreciate it. Uh, yeah, I'm happy to, um, excited to talk about, uh, kind of a, both a question that I kinda wanna pose and kinda wanna, you know, think about.
- 0:29
Uh, and then I'll just do a demo of something that, uh, basically what you can do, uh, a project that we're working on and building, uh, that you can do if you start to think about the network, uh, as more of a sandbox environment rather than, you know, just necessarily the network.
- 0:43
So, um, yeah, I mean, just kinda starting by asking the question, what are the components of a sandbox, right? You know, so I know I say that. You've probably all thought of different things.
- 0:53
You've probably all thought of probably a VM or a container and the debate between whether that's the case or whether or not the agent should go in the box or outside of the box or, you know, around the box or both or things like that.
- 1:04
Um, so, uh, you know, I'm just gonna break it down to something, you know, very simple, uh, and then kinda ask, you know, a little bit of, um, down, you know, about, uh, what it might look like at the network layer.
- 1:14
So, uh, you know, what are the components, like at the very, you know, very basic level? Like, what are the components of a sandbox? So first is a boundary, right?
- 1:22
So it's just there's a thing in and there's a thing out [laughs] right, uh, of the sandbox. And the second is a set of permissions, right? So if you don't have the set of permissions or identity that's a part of that, you, uh, you don't have a very fun sandbox, right?
- 1:37
It's a sandbox without any toys, right? It, it, it's a sandbox, but uh, it's not, there's not really anything, anything there. And so, you know, if we think about that and we think about agents, right, in a particular, like what it means to put an agent in a box or something, something similar to that, uh, you know,
- 1:53
we can kinda think about how permissions are typically handled today and what that means. And so it's one of two ways, right? It's typically one of two ways. It's, there's the first way, which I think is what the major model labs, uh, would really like you to do, which is use API keys, right?
- 2:06
So you're paying the full price. Um, uh [laughs], and, uh, you know, that's one. Uh, and you know, that doesn't also get at the heart of the true like AuthN versus AuthZ, right?
- 2:14
It's just like, here's an API key. It lets you, you know, it lets you have access, right, to like, to, to, you know, all of the models or some of the models or, or things like that.
- 2:23
And the other fun part is it's an API key, so even if it's a synthetic one, the models are very clever at, uh, doing things with keys that they maybe shouldn't necessarily do, uh, especially if you run them in a loop for a very long time.
- 2:36
Uh, and then the other, you know, other way, you know, the, uh, maybe the more cost-effective way, uh, is to use, you know, OAuth or, you know, OIDC in terms of like, uh, you know, actually handling the permissions for your agent.
- 2:47
So, um, but again, both of these things are actually things that happen, like you do them in the sandbox, right? So like your key goes in the sandbox, uh, or you know, you've like logged into your agent, and it's running over there somewhere.
- 2:58
You know, your OpenClaus running over there with your, uh, you know, your account just kinda hanging out over there in the, you know, in the corner. Um, and so, um, yeah, so that, what that means is like the, the, um, you know, is the agent has access, right, to its kind of own permissions, right?
- 3:14
It's in a box, but it act- it actually has access to the thing, uh, to give it permissions. And so my question is, you know, what if we, you know, again, what if we used the network?
- 3:21
What if we thought about the network? And I don't know who's familiar with WireGuard, like the WireGuard protocol? Okay, yeah, most people. Uh, um, but yeah, so, uh, you know, what WireGuard lets us do, and that's what Tailscale is built on top of, uh, is, uh, WireGuard basically lets us, you know, give a set of keys to
- 3:37
all of the, you know, any node on a given network. Uh, and then at Tailscale, we're actually able to put kind of like the, the identity component on top of that.
- 3:45
Uh, and so, uh, you know, here, basically we kinda have the question of this is, this is effectively what Tailscale is. And, uh, we're, we're sort of kind of asking the question is like what if we took the components of like AuthN and AuthZ and we just stuck them at the network level?
- 3:58
So, uh, at least on a, you know, on a tailnet, right? So we're using WireGuard to establish these connections, and these are direct connections between anything that you might think, so a container, uh, a GPU server, you know, your laptop, a phone, a whatever.
- 4:11
Uh, we are able to say, um, so in each connection, uh, we're able to give like the actual identity of what and who might be connecting. So, uh, with each connection that happens over Tailscale, uh, you get a user if that user is logged into the device.
- 4:28
You get all of the groups, like in that sense of like if you're SCIM syncing groups, so like if you're in the engineering org or, or things along those lines, uh, you get all of, you can get all of those.
- 4:37
You can get, uh, you know, if this is a, like an agent, so like a PR review bot maybe that you have running somewhere, right, in a, in a GitHub Action, uh, it can be a tag or a set of tags.
- 4:46
So this is the PR review bot for this project, or this is the PR review bot for this sort of thing. Um, and you know, we can take that and apply it to every single network connection.
- 4:54
So not only can we, um, uh, we can basically govern network access based on that, so you can't even talk to something if you don't have a certain set of permissions.
- 5:02
But the thing on the other side actually also gets all of the information. So there's a very... I mean, if you're used to doing things with networking, you're probably used to doing things with like IP address or like, you know, here's a thing over here, and like we're kind of like, you know, connecting things or, you know,
- 5:17
it's IP address plus some key, again, like an API key that your service is providing. Uh, this is all kind of in one, uh, so the connections happen, you know, like the connections happen with identity.
- 5:28
And so what that lets you do is it lets you build some very interesting applications, uh [laughs], uh, on top of that. So, uh, and I realize this is very dark here on the screen, so I apologize.
- 5:38
Um, the, uh, um- Lets you build some very interesting applications. One of which, uh, we happen to build is an AI gateway. So, uh, what's happening here is, um, you know, everybody's probably, you know, familiar with kinda your typical LLMs.
- 5:53
This is, you know, LLM gateway, right? Uh, Aperture works the same from that perspective. So you take, like, a single key from a provider, uh, you know, be it, you know, Anthropic or OpenAI or, you know, Gemini or Vertex or Bedrock or whatever.
- 6:04
You can take a single key from any given provider, you can put it on Aperture, and then on the other side... So Aperture is just a node, again, on this network.
- 6:11
So it's like a node, uh, node that you deploy onto this network, so it is actually able to see all of the identity from everything that's talking to it.
- 6:18
So in the case of a agent in a sandbox, that sandbox has a tag. That sandbox is like, uh... We can think of, in this case, let's think of, like, Gi- a GitHub Action runner, uh, as sort of a sandbox that your agent is running in.
- 6:30
Uh, you can use something like the federated OIDC from GitHub. Uh, that will s- basically, when that, that runner spins up, that runner will suddenly... Uh, basically it gets the access into the tailnet, it gets a tag on that tailnet, and that tag on the tailnet is what determines, uh, what it is able to do, uh, via
- 6:48
or through Aperture, uh, because again, it can see that. Um, and I'll show you an example in just a second. Um,
- 6:55
so yeah. So that's, that's kinda like where we are. So we have, you know, single key on Aperture. You can then write all your rules in Aperture and then on the other side, there's actually no key.
- 7:03
It's just... So, like, that runner connecting from the sandbox has no key to accidentally exfil or share or do something with, uh, or, you know, kind of go beyond its boundaries.
- 7:13
There... It's just no key whatsoever in, in that sandbox. Um, so yeah. So that's, that's that. And just to kinda show you, like, live, I, I kinda like to...
- 7:22
I, I actually prefer to just show things. Sorry, here. Just show things live. Um, so this is Aperture, just kinda like I had the screenshot before and let me change it to be...
- 7:32
We're gonna go light mode, just to make things easier to read. [laughs] Um, uh, so, so this is Aperture. Again, this is what I was showing you. Um, this is my view into, like, my Aperture instance.
- 7:42
So I am connected here. I'm actually on our corporate tailnet. Uh, so I'm logged in on our corporate tailnet. Uh, I have visited Aperture as a user. It knows who I am.
- 7:53
Uh, I'm on my laptop, right? So I, I'm just on my laptop. It knows I'm, I'm logged in as me. Uh, and so it's showing me all of my, uh, like, usage metrics on our, you know, kind of like demo instance here.
- 8:04
Uh, and so, you know, I can see, you know, all the tokens that I've used, I can see the models that I've used, I can see how much money I've spent on the given models, uh, on any given model.
- 8:14
Uh, and then I can even see all of the requests, uh, that have come through the gateway from my particular identity. So that works for me. That also works for everything else.
- 8:23
Um, I can even drill down and see, like, uh... So this was me testing it before, and, uh, I can show you live. But I just asked it to say hello, uh, and with all of the context in Claude Code, even if you just ask it to say hello, that cost you 20 cents.
- 8:36
That's a, you know. [laughs] Uh, it cost me 20 cents, but the, the next one is not as, [laughs] is not as expensive. Uh, but I can actually even go in here and, you know, see all of the request headers, res- request, response body, you know, everything here.
- 8:48
And if I scroll all the way down, uh, there should be, uh...
- 8:53
Oh, yeah. See, this is everything. This... In case you were wondering, this is everything that Claude Code sends at the very beginning. And so if, if I say... [keyboard clacking] Here, let's say, "Hello."
- 9:05
Oh, no. Well, maybe I didn't [laughs] do it right there. [laughs] The, uh, uh, this is liter- literally everything that Claude sends right off the, like, right off the bat as a particular, uh, request, and then you can see the response and the response body.
- 9:16
Uh... Oh, sorry. I asked it to tell me a 10-word story, so there we go. Uh, um, you know, a cat sat on a mat and then simply vanished.
- 9:22
But this is the, like... This is what's actually going through the, the gateway when you make that first, like, very first request, uh, from Claude Code. Um, so yeah.
- 9:31
So that's, that's that. If I wanted to look at me, right? See, that's me here. I can see my, my session. This is my Claude Code session with two, uh, you know, with two requests here.
- 9:40
So there was the haiku thing to tell me, you know, to give me the summary of what was going on, and the 20 cents I spent to, to get that 10-word story.
- 9:47
And then I can even also... So, you know, I mentioned, like, GitHub Actions runners, so this is actually a PR review bot, uh, that we have. You know, it's just a small, like, simple check, uh, that we have run on, on every PR, like, update.
- 10:00
And so you can even see here, right? So this is it. It has a tag. It's our dogfood tag. Uh, and, uh, you know, you can see everything that the dogfood bot has done here, uh, over the last 30 days.
- 10:13
And I can open it up, I can take a look, I can see every single request that it's run, and I can even take a look at something like this, and we can see, you know, here it spent four cents, uh, and, uh, it ran three commands, uh, at the same time.
- 10:26
So I'm actually able to see all of the, like, bash commands and everything along those lines, uh, here. Uh,
- 10:32
yeah. So, you know, that's the case there. Uh, you know, I, you know, I mentioned seeing those bash commands. You can actually extract, and it's a fun part about working at the LLM layer and having everything at the network layer.
- 10:43
There's no, uh... I have sort of a guarantee, uh, that I've seen every tool call that this thing has ever, like, this thing has ever made, uh, through the instance.
- 10:52
This is not happening, like, from inside the container. This is not happening from the harness or anything along those lines. If it had to make a tool call, it had to go through Aperture, and we would, you know, we would extract it here, and you would, you would see it.
- 11:04
So if I, like, go here, and, you know, uh, you can see all of the, uh, you know, all of the tool calls that it made. It, you know, requested an MCP tool call to update the code review, did some bash, did some grep, you know, and then re-updated the comment on the code review.
- 11:17
And there's no, like... Uh, again, we see everything, so right. And if you wanted to cut it off or you wanted to stop it, uh, it's happening at the network layer, network layer, so the moment you say [snaps fingers]
- 11:27
no, it, it's not like it has a key and then can be like, "Oh, I see the key no longer works. Let me go to this other endpoint," right?
- 11:33
Or, "Let me try this other thing," or, "Let me do this," you know? You know, I mean, it would be very helpful here, right? It literally is like, "Oh, uh, key no longer work."
- 11:41
It's just, it's just a dash. So, uh, and just to show you that, um, we have our, like, sort of agent, uh, agent sandbox script. This is all you actually Have to do.
- 11:50
So in like Claude Code, it's just, "Hey, you're gonna run an API key mode." Here's a dash, like just so you have something so you don't complain that there is no API key for API key mode.
- 12:00
And then here is the endpoint that you need to, you know, the base URL that you need to use. And it, again, it works across, you know, like Codex or Claude Code or Gemini CLI.
- 12:08
Uh, and here's what you need to use, and you know, when you do that, uh, you can just, again, I can say, you know, I'm gonna say Claude. Uh, this is my actual settings.json.
- 12:17
You can see the same little same things up here at the top. Uh, but you know, I can do that and I can say, you know, again, "Tell me a, a 10-word story."
- 12:26
By the way, if I... When I asked it to tell me a 10-word story like three weeks ago, it was all about robots, and then it became about dogs, and then now it's about cats.
- 12:34
So if there's a sort of, uh, I don't know, model eval suite or something like that, I don't know. You can tell, uh, something's happening, uh, on the back end. [laughs]
- 12:43
Um, so you know, in terms of what they do. They got a cat... You know, cat sat on a mat and then found a home. But-
- 12:49
It's only nine words.
- 12:51
Yeah, actually, wow. So still can't count. [laughs] Uh, that's fun.
- 12:55
You're good.
- 12:56
Opus 4.6, one million context. Uh, uh, you know, um... [laughs]
- 13:04
So it takes an hour now.
- 13:06
Uh. [laughs] There we go, right. [laughs] Uh, uh, and then finally found home. So there we go, right? [laughs] You know. It just forgot the extra bit. Um, but again, you know, if we wanted to see that, right?
- 13:20
You know, hey, you've got a pipeline that, you know, actually depends on that being 10 words or something, you know, or having a certain structure. Uh, things can easily break, like in a PR review bot and, you know, that can happen.
- 13:31
And when it happens in like something like a PR review bot, it's hard to actually know what's going on or, you know, what happened or when. Um, you know, I can go back to my logs, right?
- 13:39
Here, here's my session, right, with three requests instead. And you know, here they all are, right? Here's the summary thing, and then here's the first request with the, all, you know, all of the input tokens.
- 13:48
Uh, you know, that was the 20 cents, and then here's the, you know, "Are you sure about that?" Uh, and you know, here's the, "You're right, that was nine." [laughs]
- 13:56
Uh, so you know, again, if you're trying to go back and, and look at certain things, you can do that here as well. Uh, and again, there's no hiding it from you 'cause it's not like, you know, I'm gonna be super helpful and go do this thing and all that sort of stuff and go around.
- 14:07
Uh, it's, you know, it's, it just has to, has to be here. Uh, one other fun thing that you can do here in the middle is, um, well you know, first we can also do like costs and cost controls and, you know, all those sorts of things that actually work across providers.
- 14:21
So if you wanna set a budget or like a, like a, some sort of budget in, in Aperture, you can actually have it work across every provider. It's not like, here's $1,000 for everybody.
- 14:30
It's here's just $1,000, and you can decide to use it how you wish. Um, and then the other thing is you can actually do integrations. So we offer web hooks, uh, on top of this, uh, where for each of those tool calls or for each of those things, you can actually send a request out to a third
- 14:44
party, uh, to, um, uh, you know, with all of the information about the tool call. Uh, and again, there's no hiding it. It just, it has to go through here, uh, so you can, you know, these hooks are basically guaranteed to sort of exist, right, and run, uh, no matter, no matter what.
- 15:00
Um, so yeah. So, so yeah, that's, that's, uh, uh, that's mostly it. If you wanna, you know, like again, if you wanna set up things like quotas, you can actually, you know, go in, say, "Hey, here's, you know, you get $5 a day," you know, all those sorts of things.
- 15:12
And, um, kinda, you know, have a sort of much safe fun, [laughs] I guess you could say, as you, uh, as you, as you want to, uh, in the, you know, through the gateway.
- 15:20
And again, it works with pretty much any provider that you can imagine across the board, um, that supports the major, major context. And so, you know, I kind of talked about this at the beginning, but, um, this is Aperture, right?
- 15:31
This is a thing that, you know, that we have built, uh, and that you can use. Uh, it is available on our free plan. However, it is built using the Tailscale identity primitives, and those are...
- 15:42
And that is all available via like a, an open source library we have called tsnet where you can write your own go program, right, that actually puts itself on the tailnet and can read all of the same identity information, can read everything else.
- 15:55
Uh, and so you can do things like if you wanna build an MCP server but it's internal to your org or something along those lines or an API endpoint or something that's internal to your org, you don't have to think about OAuth or just think about opening it up to everybody.
- 16:09
You can actually do the exact same thing and be like, "Hey, who made this request?" You know, I'm gonna, you know, force that into, you know, whatever, uh, you know, whatever thing I'm proxying on the, you know, on the MCP side or, or things along those lines.
- 16:22
So you can actually take all of that same, uh, you know, all that same information and do it yourself. Hilariously, you can actually build Aperture yourself if you really wanted to, [laughs] uh, using the same things.
- 16:31
We had a whole charge here which was, uh, it had to be built on top of Tailscale. It couldn't be built like inside w- using private API endpoints or anything along those lines.
- 16:40
Uh, so this is actually built entirely in a way that, in theory, you could go build too, uh, to yourself. So, um, yeah, I'm, you know... If any ideas have come from this, if you think about, you know, things that you would like to build internally, I would love to, you know, would love to hear and would
- 16:54
love to chat, chat afterwards. So yeah, I think I'm like a minute under here and, uh, yeah, so I... You know, if there is a question, I'm happy to, happy to answer it.
- 17:03
Uh, yeah, yeah. [laughs]
- 17:04
How do you configure the permissions?
- 17:06
How do you configure the permissions for like who can a- So the question is how can you configure the per- permissions? And are you saying is it like for who can access what?
- 17:12
Or who gets to s-
- 17:13
Yeah. I guess like can you, you can make these tool calls and not these or...
- 17:17
Yeah. So all of the, um... So we actually can let you configure them in two places. So there's, it's another fun little feature of like, uh, how Tailscale identity and how like that sort of stuff gets pushed through the network.
- 17:27
First is, uh, you actually can set them up here in Grants. Uh, so you know, you can s- ask, say, who this applies to. We're gonna be adding like the groups and everything soon here as well.
- 17:36
Uh, but then you can say like, uh, we actually also have an MCP server in, like an MCP proxy in here as well. So you can say model access and quotas, MCP access, hooks, roles, like, you know, kind of everything along those lines.
- 17:48
Uh, you can do the grants. You can even also define those. So Tailscale as a whole has a policy file that you can, uh, that you can use. Um, it's how you define who can access what on the network.
- 17:59
Uh, you can actually put this sort of, these are called applica- This right here is called like an application capability. Uh, you can actually stick that in your main ACL file or your main access control file to send along with the identity.
- 18:11
So you not only can you send like- ... the user or the tags or everything else. You can actually send any arbitrary metadata that you want, uh, guaranteed by the Tailscale control plane as well.
- 18:21
Um, so yeah, so we, we try to, you know, we have the visual editor, but we also ... Everything is, like, a- you're ... possible to do in JSON, just, you know, most folks, a lot of folks using this at scale are ...
- 18:31
They wanna put it in some sort of GitOps workflow. So, uh, you know, we have that. We have the API as well to ... If you actually wanna, like, just, you know, put this as part of some sort of GitOps workflow that you have, um, to do that.
- 18:42
Any other, any other questions? I think that was ... Yeah.
- 18:46
I think I saw you for ... When you were setting up in full code, you set the base URL to your-
- 18:51
Mm-hmm
- 18:51
... Aperture node rather than, like, the default-
- 18:54
Yes
- 18:54
... for most devs. Is it possible to catch that just, like, at the network layer and just sub it out-
- 18:58
Yeah
- 18:58
... everything that full code instead goes to your node?
- 19:01
Yeah. So the question is, uh, do you have to put the base URL in, or is it possible to kind of, like, capture that at the network layer and just kind of transparent there?
- 19:08
Um, that is something we could do. That was kind of a big point of discussion when we were first, you know, thinking about this, and, um, in reality it kinda ...
- 19:16
It's not ... While we could, it's not really something that we, uh, um ... It's not really in the ta- I wouldn't call it the Tailscale way necessarily. The whole point here is we wanna make things, like, really, really easy.
- 19:28
Like, like, for you to ... You know, you wanna be able to get, you know, LLM access in, or, you know, into a sandbox. You wanna be able to do, you know, on somebody's computer.
- 19:35
We wanna make that s- like, super, super easy, [laughs] uh, from the outset. I realize, you know, there's some transparency stuff, but, you know, when you do that things can kinda start to break and shift and kind of move.
- 19:46
Yeah, and it gets very confusing and moves out from under you. You know, we just wanna make it the easiest way for you to actually, you know, offer this sort of LLM access and not, uh, necessarily, you know, kind of do it hidden under the surface where you're, you're kinda doing everything else.
- 19:59
So, um, it's, it's definitely meant for folks who wanna build, you know, with AI, and then on the other side, right, as, like, a security or an IT admin, it's like, great.
- 20:07
You get easy-to-use controls. You get easy to, you know, like, easy to kind of ... You get to see all of the tool calls. You get to see, you know, all of those sorts of things.
- 20:14
So we're really trying to do the best of, best of both worlds, uh, for, you know, both devs and the kind of, you know, IT/security, like, manager.
- 20:24
Yeah.
- 20:25
Can you do, like, role-based, uh ... Like, can you say, like, these users are allowed to use these tools, or is it just the model and the provider?
- 20:31
Uh, so it's ... Today, it's, uh, w- we're ... Yes, we w- wanna, uh, work- working on that. And today it's model, provider. Uh, you can think of basically anything that we would put through Aperture, you should be able to say, "Hey, this group, or this, you know, as defined by my SCIM provider, as defined by, you
- 20:48
know, whatever, gets access to model." Uh, it- it's not just model and provider. It's also all of the quota stuff, you know, that I kinda glossed it. That all also has the same sort of, uh, permissioning system.
- 21:00
So you can say, "This team gets this big budget. You know, each individual gets this, you know, smaller budget." And then, you know, we kinda do the, you know, the union of the two there.
- 21:11
Or, you know, or even do it where it's like, you know, you can use as much as you want of the internal GPU, you know, like, you know, kinda like the internal GPU endpoints that we're hosting.
- 21:21
But, you know, if it's Opus 4.6, you only get, you know, you know, this amount or something along those lines.
- 21:27
Yeah.
- 21:28
How does permissioning work in a world where they can do tool calls, it's, it's just writing code?
- 21:33
How does permissioning work in a w- world where it doesn't do tool calls, it's just writing code?
- 21:37
Yeah. So I think ... Well, a lot of agents are at least somewhat moving away from MCP and tool calls and it's executing code, which, uh, actually makes much more-
- 21:47
So-
- 21:47
... some network requests, but it's harder to parse-
- 21:49
Yes
- 21:50
... uh, from the
- 21:51
Yeah. So, uh, you know, the question, you know, in a world where people are moving away from MCP and maybe the structured tool calling, what do we, you know, what do we, you know ...
- 21:59
How does it work? How does permissioning and things like that work? Uh, you're right. That is a little bit more complicated. However, it's the whole reason we chose to do this.
- 22:05
We had originally thought about maybe doing this at the MCP, like, just the MCP layer. Uh, and we realized it was, like, hey, it's actually way more valuable to, you know, do the LLM, the LLM layer here.
- 22:16
And this is where, you know, like, if I go to ... Well, here, we just go to the logs, and I, you know, I go again to, uh, not to the chat, but to the, you know, a given ...
- 22:26
Here, let's see, the given metric. Um, you know, this is ... Right? So even with skills and everything else, write or code, you're still running a ... Like, you're typically still running something.
- 22:38
Yeah.
- 22:38
Uh, now of course you could write the thing, maybe obfuscate the thing, and then run the thing. Uh, you know, one step at a time, [laughs] uh, kinda, you know, kinda thing.
- 22:46
Uh, um, you know, and a lot of folks, to be honest, a lot of folks that we talk to are like, "I don't even know what tools people are using.
- 22:51
Like, please just tell m- Like, forget about blocking it for a second. I don't even ... Like, what are people even doing, right?" You know, it's like, 'cause MCP was all the rage, and it's like, are they using MCPs?
- 23:00
Are they just using batch commands? I can tell you internally, like, this is ... Sorry, this is just our demo instance, but internally if you were to look at our actual instance, Bash dominates-
- 23:09
Yeah
- 23:09
... everything else. Um, but again, we get to see the command, uh, and we typically, you know, w- we, so we get to see all the commands and, you know, and everything that's actually being run.
- 23:18
Uh, and we'll be adding in more guardrails along the lines of, like, hey, you can, you know, this is the Bash command. Let's, you know, if it's RM-RF/, right? [laughs]
- 23:28
Uh, maybe not. You know, or, [laughs] you know, uh, uh, you know, or something along those lines. Uh, you know, we'll be, we'll be adding that in. But that's the whole reason why we decided to do it at the LLM layer.
- 23:39
Um, so yeah, we, we had that whole discussion of, like, well, and if you can't see everything, then
- 23:47
how valuable is it? Right? You know, if you can't see everything. And so we wanted to be able to see, uh, um, you know, at least from particular agents that you wanna put there, you know.
- 23:55
Um, yeah. Any other ... I mean, I was gonna say, I don't, you know, I don't know exactly what the time is here, but uh, um, I know we're, we're kinda at the end.
- 24:03
Uh, I'm happy to answer any other questions downstairs if you wanna come to the booth or in the hall. Um, but yeah, thank you. [clapping] [outro music]