Security is a property of the factory

An agent can expose sensitive context long before production. It can choose the wrong repository, carry the wrong tenant's assumptions, or make a change nobody can attribute. Security begins at the moment work is admitted.

Identity, tenant boundaries, sandbox permissions, repository scope, and release review should not be reconstructed from separate logs. They need to be part of the same work surface, so the safe path is also the easy path. Learning loops and agent teams can stay inside the tenant while an external orchestrator sees only the contracts and state it needs to coordinate.

Enterprise buyers do not need a trust slogan. They need to know who acted, what they could touch, what changed, and who approved the release. Armalo makes those questions part of the factory instead of a quarterly scramble.

Security teams often inventory credentials and forget that context is itself a capability. A repository tree, an incident transcript, a ticket attachment, and a model response can each change what an agent believes it is allowed to do. The admission layer must classify not only the data, but the instruction path that introduced it. Otherwise a poisoned document can become an unaudited policy change.

The practical control is boring and powerful: bind every admitted artifact to a tenant, purpose, actor, and expiry. Let the worker see only the projection it needs. When a tool response asks for a new permission, make that request visible as a decision—not an invisible continuation of the previous turn.

A policy that produces a dashboard after the fact is an observation. A policy that blocks an unscoped read before it happens is a control. This distinction matters in agentic systems because speed makes accidental bypass look like success.

Test the factory with hostile normality: the wrong repository selected, a stale approval, a cross-tenant identifier, a secret-shaped string in a log, a release whose tests ran against a different commit. The system should fail closed with a reason a second operator can act on. That is how security becomes a property of the factory rather than a specialist's hope.

Once identity, scope, and evidence travel with the work, security stops being the department that slows delivery and becomes the department that makes more delivery possible. Engineers receive a smaller, clearer permission surface. Reviewers receive the context they need. Leaders can approve autonomy because the boundary is inspectable.

The question is no longer whether an agent is safe in the abstract. It is whether this particular action, in this tenant, under this authority, with this evidence, is safe enough to continue. That is a question a factory can answer.