Running Enterprise AI Agents as User Identities

Identity and Infrastructure

Two Sigma avoids the security and management overhead of separate machine identities for AI agents by running them as the user's own identity. The firm leverages existing infrastructure where every employee is assigned a dedicated Kubernetes namespace in every region, originally built for automated research jobs. A sidecar container in each pod pulls the user's identity credentials, ensuring the agent operates with the same permissions and access as the human employee. This approach eliminates the need to synchronize permissions between a user and a secondary agent identity, while also bypassing issues with systems that refuse to handle multiple identities for a single data source.

Audit and Provenance

To distinguish between human-initiated actions and agent-initiated actions, the firm propagates a custom trace header through all agentic workflows. This header functions similarly to a standard trace ID in distributed systems, allowing the security team to attribute actions to the specific actor and replay the entire chain of events leading to a result. By enforcing this header propagation through standardized agent harnesses and frameworks, the firm maintains full provenance for every action taken within the agent ecosystem.

Web Access and Risk Mitigation

To provide agents with web access while preventing exfiltration and prompt injection, the firm blocks native search and fetch tools (such as Brave search) within agent frameworks. Instead, they route all web queries through Google's Web Grounding for Enterprise. This service provides a search index that remains within the firm's existing VPC and network boundary. While this introduces a data freshness lag of approximately 24 hours, the firm determined that the reduction in external egress vulnerability significantly outweighs the cost of delayed information.