If the answer is "a safety prompt" or "nothing really" — this page is for you. Your AI operates under a Unix account. That account has permissions. There is nothing between what the AI proposes and what executes except the AI's own behavior. That behavior is probabilistic. Probabilistic sometimes means wrong.
Sometimes it already happened. Sometimes it hasn't yet and you're trying to make sure it doesn't. Either way the underlying situation is the same: an AI with access to a Unix account, and no hard boundary between what it proposes and what actually runs.
A safety prompt is a request. The AI might honor it. It might not. Probabilistic means sometimes wrong — and when wrong on a system command the consequences are immediate and often irreversible.
The tools people are running when this problem appears:
These tools have terminal and shell access by design. They execute commands, modify files, run builds, manage dependencies, and interact with version control. The permission models they ship with are convenience features, not compliance controls. They produce no tamper-evident audit trail.
Developers running local models and connecting them to shell tools, file systems, or databases through agent frameworks. No built-in safety layer. The model runs under a Unix account. Whatever that account can reach, the model can reach.
AI agents performing operational tasks — infrastructure maintenance, CI/CD repair, dependency management, repository triage, automated diagnostics. These agents generate shell commands dynamically based on system state. No human in the loop for every action.
AI with database access is the highest-stakes scenario. A model that can query can also drop, truncate, update, or expose. The incident that sends most people searching is an AI that accessed production data, ran a destructive query, or exposed database credentials while completing a task.
In regulated environments the question comes from outside — an auditor, a compliance officer, a client security review. The question is not whether the AI behaved well. The question is whether you can prove what it was authorized to do and produce a record of what it actually did.
The HIPAA Security Rule requires access controls, audit controls, and integrity controls for systems handling protected health information. When an AI agent operates in a healthcare environment the same controls apply to its actions that apply to any other process. A safety prompt satisfies none of them.
An AI agent with unrestricted shell access to a system in the cardholder data environment is a control failure by definition. PCI-DSS requires restricted access, full monitoring, and documented authorization. SOC 2 audits evaluate logical access controls and change management evidence. Neither is satisfied by model behavior alone.
CMMC Level 2 requires audit log protection — logs must be protected from modification and unauthorized access. AI tools are being adopted faster than compliance frameworks can formally address them. A deterministic, auditable, dependency-free policy layer maps directly to existing CMMC requirements without waiting for AI-specific guidance.
AI-assisted DevOps teams and organizations running autonomous agents for infrastructure work face the same exposure as regulated industries — without the compliance deadline to force action. An AI agent with unrestricted shell access to production infrastructure is a single misconfiguration away from a significant incident.
A policy layer that sits between the AI and the Linux execution environment. Every AI-issued command is evaluated before anything runs. You define what is permitted, what requires human approval, what is denied outright. The boundary is real — the AI account has no path around it.
Every decision is logged before execution. What was proposed, what was decided, why. Not a chat log. A tamper-evident audit trail the kind a compliance auditor can verify.
The moment that changes how you think about it: configure the AI's account so the only binary it can reach is the policy gate. Now the AI cannot execute anything directly. It can only make requests. Every request is evaluated. Every decision is recorded. You have moved from hoping the AI behaves to making unauthorized execution structurally impossible.