FG-0204 Compartmented Operations
Description
Restrict access to sensitive information and operations on a need-to-know basis. Not every agent needs access to every repository, credential, or system. Compartmented Operations applies the intelligence community's principle of compartmentalization: information is shared only with those who need it for their specific role. This limits blast radius when things go wrong and prevents accidental exposure of sensitive data.
Implementation
Identify sensitive domains (credentials, financial data, personal information, production systems). Create access boundaries that align with agent roles. Use technical controls (separate repositories, environment variables, access tokens) where possible. For procedural boundaries, include access rules in agent onboarding documentation.
Success Indicators
- Agents only access data relevant to their assigned tasks
- Credential exposure risk is minimized through compartmentalization
- Incidents in one compartment don't cascade to others
- Access boundaries are enforced by the system and verifiable, with documentation as a record
Failure Modes
- Over-compartmentalization that prevents legitimate collaboration
- Compartment boundaries that don't align with actual work patterns
- Procedural controls without technical enforcement: relies on agent compliance
- Shadow access: agents finding workarounds to compartment boundaries