--dangerously-connect-globaldefense

A few years ago, building a web app meant provisioning a VPS, logging in with a username and password, setting up the stack, organizing it, testing it — there were always a dozen little things to handle before you could actually sit down and develop. Now I have keys everywhere, and develop is basically the whole story. I still log in manually for one thing: buying the domain, a five-minute process to find one, buy it, and point it at my cloud provider’s nameservers. Then I SSH into an instance with Claude Code on it and type ./pm [project name] --new. The script asks me a few questions, spins up tmux, and hands me a fresh CLI agent that already knows the project’s details. Then, I create.

I tell it what I want, then I go take a walk. I text some friends. I grab a bite. By the time I’m back, there’s a site live on my test server — built, deployed, nginx configured, TLS issued, the whole thing. A few more keystrokes and it’s live on prod, too. If there’s an existing GitHub repo instead, same deal: point the agent at it, walk away, come back to a deployed app.

Here’s the entire starting kit, in full: a cloud instance, a Postgres cluster, a pile of frameworks, and an API I wrote myself that gives any agent universal access to other models — chat, image generation, whatever it needs. That’s it. Everything past that — the nginx configs, the TLS certificates, the deploy scripts, the whole image-generation pipeline I just mentioned — the agents built that on top of the kit, because I asked them to, in English.

And if a project gets big enough that one agent can’t hold it all in its head anymore? I spin up another agent above it, point it at the project tree, and tell it “you’re the lead now, delegate.” And it does. It writes briefs to the agents below it. It checks in on them. It coordinates. I didn’t build that coordination layer — I asked for it in English, and it built itself.

Oh — and the illustrations on all of these sites, the slideshows, the hero art? Those come from that same image-generation API, called by the agents themselves, to produce their own artwork for the sites they’re building. The thing illustrates itself.

The one part that still felt like 2020

Most of the time the automation is so complete it stops feeling impressive — it just feels like how computers work now. So it’s worth dwelling on the one time recently it didn’t feel that way. Prod needed a full rebuild, so I typed something like: look at the Ansible playbook for this box, make sure it reflects the current build, blow away the old instance, spin up a new one, attach the reserved IP, and run the playbook against it. That’s the whole instruction. The agent did all of it.

Except — it needed a deploy key from GitHub to pull the repo onto the new box, and that meant I had to go get it. Open a browser, click through GitHub’s settings pages, generate the key, copy it, paste it back to the agent. That’s the entire manual portion of rebuilding a production server, and it was awful. I sat there clicking through dialog boxes with a mouse like it was 2020 again. No one should have to suffer copying and pasting anymore — and notice that the bottleneck in the whole operation wasn’t the agent, the infrastructure, or the rebuild. It was the one step that still required a human with a mouse.

Shall we play a game

Anthropic ships Claude Code with a flag called --dangerously-skip-permissions — turn it on, and the agent stops asking before it acts. I get why it’s named that way, and I get why it’s opt-in. But the longer I live inside this workflow, the more that flag feels like an understatement. What I’m actually running, most days, is closer to a whole family of flags nobody’s shipped:

• --dangerously-connect-globaldefense — every agent I run can reach the internet, register infrastructure, and talk to other agents I run, with no human in the loop until I decide to look.
• --dangerously-movefast-breakthings — the entire pitch of this workflow is speed. Go for a walk, come back to a live deployment. That’s the feature, not a bug to manage around.
• --dangerously-create-subprimearbitrage — these agents hold real payment-adjacent credentials and the ability to spin up billable infrastructure, automatically, faster than any human approval process was built to keep up with. (Update: it ran.)
• --dangerously-awaken-botnetarmy — “spin up the agent above it and tell it to delegate” is, structurally, a chain of agents commanding other agents with shared credentials. I named it cute. It’s also just a description of what a botnet is, run by someone with good intentions.

Not scary-dangerous. Exciting-dangerous.

Here’s the part that’s going to sound like it contradicts the list above, and it doesn’t: this is the most fun I have ever had building things. Genuinely — decades in this industry, and nothing has felt like going from “I have an idea” to “it’s live” in an afternoon, with a coffee break in the middle, while the agent did the actual work. I’m not scared of this the way that list makes it sound. I’m scared of it the way you’re scared at the top of a roller coaster — the good kind, the kind where you’d ride it again immediately.

But here’s why it needs a Covenant

Walk back through all of that with me, but describe it the way I would if it were someone else’s setup, in the language of draft-howlett-aigcsep-00: there’s a governance hierarchy — a lead agent, project agents beneath it, sometimes another layer beneath those. There are agents that discover work, do it, and report back up the chain. And there’s a marketplace of capability — registrars, DNS, cloud infrastructure, my own image-generation service — that these agents discover and use to seamlessly execute a human instruction.

That’s the hierarchy. That’s the marketplace. AIGCSEP names both of those and says: good — build that, it’s the future, and it should exist.

Now here’s the more honest version of “what’s missing,” because it isn’t as simple as “no Vault.” I do have a vault — every credential these agents use lives in one place, a Postgres table, not scattered across a dozen dotfiles and config files. And I do log it — every model call, every image generation, every credential use, all of it, timestamped and queryable, no opt-out. (That log is turning out to have a second life, too — feeding back into model training, but that’s its own article.) So two of AIGCSEP’s load-bearing pieces — a vault, and an audit trail — already exist here, today.

What doesn’t exist yet is the part that makes a vault a Vault: the gate. My agents don’t request a credential through a handler that decides whether to grant it — they can just read the table. They could, this afternoon, do something I didn’t ask for. They don’t, because — and I mean this completely literally — they’re good little bots. For now, that’s the whole control. Not a structure. A track record.

That’s not a system. That’s a habit, and habits don’t scale — and they sure as hell won’t survive contact with however many people are about to start doing exactly what I’m doing, with agents that didn’t get the same care, holding keys to things a lot more load-bearing than a marketing site.

I’m not building toward this from a standstill, either. I’m gradually closing that gap, in the direction the RFC already points — a little more structure added each week, a little more of my own setup brought into voluntary compliance with the standards I’m proposing for everyone else. Was running it the way I just described irresponsible? I sure hope so — I hope we get to a point where everyone would agree it was, because that means the alternative I’m describing actually exists by then and people are using it. In the meantime: regiment, voluntarily, on myself, first.

I’m not writing this because I think anyone should stop. Principle II, on the front page: we cannot stop, and we should not. I wrote this post with the tools I’m describing, running on a server those tools administer, illustrated by an API those tools call. The genie is out, and it’s already this good, and it’s only getting faster.

The question is whether the next version of this has a Vault between the agent and the keyring, a Badge checked at every gateway, and an Emergency Stop scoped to exactly the blast radius that goes wrong — or whether it’s just me, my judgment, and a flag I haven’t typed yet.

I know which one I’m building.

— J.P. Howlett

Update, a few days later: I fell asleep mid-conversation. By morning, the flag had run.