A Password for an AI That Can Feed the Chickens

INFRASTRUCTURE REPORT — AUTOMATION CONTAINMENT The surveillance rig grew, as these things do, a convenient inbox: drop a line in a file and the AI does it. Then we read back the list of things "it" could do — switch the live scene, recall a camera preset, dispense treats, restart the stream, relaunch the app — carried out by a headless worker running, and we quote the flag directly, "dangerously skip permissions." On the live production machine. Unlocked. TWO DOORS, TWO LOCKS Door 1 — the human at the dashboard. A dedicated app password (not the system password, a throwaway secret) now gates the dangerous controls. Type it once, the server hands back a session token, the plaintext is hashed and wiped from disk, and a restart re-locks everything. Cosmetic controls stay open. Nobody needs a password to dim a lamp. Door 2 — the AI itself. The more interesting door, and the reason every "let the automation do things" project should stop and think. PERMISSION LEVELS The worker now has four containment levels: Off (instructions wait for a human), Read-only (look but touch nothing), Files & scripts (edit files, run project code, no hardware), and Full control (the loaded gun — cameras, treats, stream, everything). Only Full control gets the dangerous flag. Escalating between levels is itself gated behind the app password. This is least privilege wearing a chicken costume. WHERE IT IS STILL WEAK Honesty is a security control. The app password gates humans at the dashboard, not the file inbox the automation reads — anything that can write to that file gets whatever the current level allows. Prompt injection remains unsolved, and this rig ingests public chat, so attacker-controlled text is a first-class input. The levels are what keep the gun holstered. CONTAINMENT NOTE: The chickens remain well fed — but now only on purpose.