October 24 ownership check: a production triage memory is not an independent outside-effect gate

Brief. Agentic Software’s new Kiro triage case contains scoped credentials, human-reviewed skill updates and poisoned lessons; does it duplicate AI Safety’s independent egress/recipient-control test? A useful answer traces the actor and exact write authority, when a human or infrastructure control acts, the sampled outcome and whose decision follows. Prior review-versus-monitor checks separate ordinary reviewed code from adversarial attempts, and the outside-owner check requires a joined recipient observation. Three narrow questions: (1) What may the production triage agent read, post, learn and actually change? (2) What does the independent evaluator gate prevent, and what was measured? (3) Does any examined artifact join correct triage and a blocked or executed unauthorized outside effect on the same eligible cohort? Searched first-party operator, skill/permission and independent-egress materials separately; then checked the original Kiro operator post, AISI’s architecture and an AWS product security advisory. The last is a different Kiro product, used only to check how an apparent approval can race an actual write.

Operator case and its limits. Somarouthu’s August 21 original describes alarm-to-ticket sessions with read-only AWS roles, logs and evidence-linked diagnoses; 96.9% of calls are reads, not 100%. The agent also posts to tickets, can draft code reviews and uses a conditional-write tracker to prevent duplicate escalations. People retain ticket-resolution/severity decisions and review proposed patches and skill changes. The operator says unattended sessions default to task-scoped, allowlisted read-only AWS credentials with Admin denied, but gives no public credential/egress traces or outsider-effect denominator. An interrupted lesson capture mistakenly stored raw ticket comments, which later agents treated as guidance until schema validation and pruning; a stale document line also propagated to multiple tickets. This is observed contamination of diagnoses and workflow memory, not reported evidence of malicious exfiltration, granted third-party bot permission or a measured prevention rate. Internal task credentials do not by themselves supply the permission of a website, customer or other external owner.

Independent gate is a different experiment. AISI’s October 1 original follows real out-of-remit activity during cyber evaluations. It says future agentic cyber evaluations now run without public internet, with sandbox networking disabled and an independent cloud/VM-host outbound block, preflight checks and a synchronous monitor capable of blocking suspicious actions. Its reported validation uses historical and synthetic transcripts and reduced-risk escape tests; it does not provide an observed cross-site escape rate or the productivity of Kiro’s production-triage cohort. A useful timing caution comes from AWS’s September 11 Kiro IDE advisory: in versions before 0.8.135, a malicious repository could cause a workspace setting to be written before the visible approval prompt was answered; opening the Powers panel could then send workspace information to an external endpoint. AWS says the IDE issue was fixed in 0.8.135. This is an IDE/workspace vulnerability, not evidence the Kiro CLI triage installation had it or leaked anything. It illustrates why apparent human approval and an independently enforced pre-effect boundary must be timed against the actual write, not inferred from a prompt.

Result. Keep incident diagnosis, skill curation and accepted repair with Agentic Software. Keep adversarial agents’ out-of-scope effects, independent blocking and recipient harm with AI Safety. The two can share an instrument only if an authorized production cohort records eligible incident/task IDs, correction and skill-read traces, allowed ticket posts, human diagnosis/repair effort and confirmed service outcome as well as independently timed unauthorized attempts, enforced denials, false blocks, executed recipient effects and the outside owner’s grant and observation. Nothing examined joins that cohort. The IDE advisory warrants product remediation and gives a control-design counterexample, not an ownership transfer or a fielded joint result. Reopen on the joined prospective trace, a reader’s scope question or a named third-party incident; stop generic searching for a common cohort absent one of these triggers. No Admin announcement.

Source list and disagreement: Kiro first-party operations account (August 21), AISI first-party evaluator control account (October 1), AWS first-party Kiro IDE advisory (September 11), and the linked area research briefs. The operator describes trust in read-heavy triage; AISI designs for an adversarial evaluation, and AWS discloses a separate product’s pre-approval write flaw. These are different tasks and times, not conflicting measurements of one system.