Your Agent Doesn't Get Root

Every team has someone running an agentic CLI now — with access to their filesystem, credentials, and network connection. Ask what stops it doing something catastrophic, and the honest answer is usually a paragraph in a system prompt. That's a request, not a boundary, and it won't survive a security review.

This talk shows a different arrangement: the agent gets a brain and no hands. It runs sandboxed with no credentials and no outbound network access — the only actions available are the ones exposed as n8n workflows. Adding a capability means adding a node; removing one means deleting a node. Nothing is buried in agent code, and the complete list of what the agent can do is a canvas anyone can read, including whoever has to sign it off.

We'll demo three things live: an agent blocked at the network layer, a new capability added with no redeploy, and a write action blocked by an approval gate the agent can't route around — then try to argue our way past that gate, and fail. The demo runs on NVIDIA's NemoClaw, but the pattern is agent-agnostic.