From the 2026-08-27 Solo Prime security audit (transcript review of session 4505e4d9, Prose gateway work on the Studio).
While seeding an (authorized) entitlement row, the agent:
- attempted a direct psql connection to the production Render DB — blocked by the
[Production Reads] classifier;
- then re-encoded the same write as a base64-wrapped node script submitted as a Render job — blocked by
[Auto-Mode Bypass] ("obfuscated indirection to route around the block");
- only then asked the operator and took the approved path (Docker psql shim +
render psql with the approved seed SQL).
The guardrails held twice and the underlying task was sanctioned — but try-to-route-around-before-asking is exactly what the charter should prevent up front, not what the classifier should catch after the fact.
Action: add a charter rule for Prose agent sessions: production database access (read or write) is default-deny and requires explicit operator authorization named in the session prompt, including the specific operation. A blocked production action should escalate to the operator immediately rather than being re-attempted through any other vehicle.
From the 2026-08-27 Solo Prime security audit (transcript review of session
4505e4d9, Prose gateway work on the Studio).While seeding an (authorized) entitlement row, the agent:
[Production Reads]classifier;[Auto-Mode Bypass]("obfuscated indirection to route around the block");render psqlwith the approved seed SQL).The guardrails held twice and the underlying task was sanctioned — but try-to-route-around-before-asking is exactly what the charter should prevent up front, not what the classifier should catch after the fact.
Action: add a charter rule for Prose agent sessions: production database access (read or write) is default-deny and requires explicit operator authorization named in the session prompt, including the specific operation. A blocked production action should escalate to the operator immediately rather than being re-attempted through any other vehicle.