Modal's CTO says agent customers want path and operation rules, not just site allow lists

Akshat Bubna, chief technology officer of Modal, argued that blocking AI agents by website address is not enough. He spoke on the AI Engineer show. Modal sells infrastructure for AI applications. Bubna said many of his users want rules about what an agent does on a site. They also want the agent never to see its own credentials. In his telling, a small proxy beside the agent is where those rules live.

What was said

Bubna described a setup where the agent loop is kept apart from the place where its tool calls run. That split is for security and isolation. Next to the agent runs a sidecar, a helper container that works alongside it.

His starting worry was plain. He said "the scary thing about agents is they can mess up." His example was an agent sending sensitive data to a German forum.

The basic controls he listed were which addresses can reach the agent, how it proves who it is, and which domains it can contact. For credentials, he said you should inject them so the agent cannot see them and send them elsewhere later.

Then he described a shift. A domain allow list is a list of sites the agent may contact. Bubna said "domain-related allow lists are actually not enough." A lot of Modal's users want control over which paths an agent can use on services such as Datadog or GitHub. Maybe they want to reason about specific operations. Some users now write their own lightweight proxy with custom rules. He named Ramp as a company using this successfully.

Why it matters

Our reading: a domain rule answers only one question, which is whether the agent may talk to a site. It cannot say what the agent may do there. If an agent is allowed onto GitHub, one bad step can reach everything that account can touch.

Hidden credentials limit the harm. An agent that cannot see a key cannot leak it, even when it makes a mistake. Operation-level rules in a proxy limit it further.

For buyers and builders, the questions are concrete. Can the platform set rules by path and by operation? Does the agent ever hold the real credential? Where does the proxy sit, and who writes its rules?

The other side

Bubna runs a company that sells this kind of infrastructure, so he has a stake in the argument. He gave no figures on how often agents leak data. His claims rest on what Modal's users tell him. Ramp was the only user he named, and "successfully" was his own word.

He also left a practical question open. Custom proxy rules need someone to write and maintain them. Bubna argued against vibe coding a sandbox platform, meaning having an AI write it. He said someone must keep reasoning about the security boundaries while everything changes fast. He was speaking about sandbox platforms, not proxies. He did not explain how teams should write operation-level rules.