← Original slide window

Presenter view · NCSU · September 9, 2026

Presenter notes

AI Agents in CI/CD

Original deck

Elapsed00:00:00

Move this presenter window to your laptop screen, then fullscreen the slide window.

1 / 22

Standalone presenter notes. Use local controls.

Slide 1 / 22

AI Agents in CI/CD:

0:45 allocated · target 0:00–0:45

Main point

The lecture studies delegated authority: models propose actions, while the surrounding system decides what may happen.

Speaking cues

  1. Open with your name and role, then frame the problem as delegated authority.
  2. A model proposes; the workflow grants authority and checks evidence.
  3. Name the arc: foundations, security boundaries, robustness, measurement, and research questions.
  4. Ask students to separate proved properties, measured observations, and design recommendations.
Original source slide 1 of 22
Original source slide 1
Original source slide 2 of 22
Original source slide 2 · next

Slide 2 / 22

Lecture Outline

1:00 allocated · target 0:45–1:45

Main point

Each section adds one obligation needed before a probabilistic worker can safely participate in CI/CD.

Speaking cues

  1. Foundations identify the principal, deputy, delegated objective, and authority.
  2. Security asks what can be enforced when content and model output remain untrusted.
  3. Robustness examines retries, feedback, state, and ambiguous external effects.
  4. Measurement asks whether accepted work improves outcomes after review, failure, and downstream cost.
Original source slide 2 of 22
Original source slide 2
Original source slide 3 of 22
Original source slide 3 · next

Slide 3 / 22

Agent Architecture: From Theory to Tool-Use LLMs

3:00 allocated · target 1:45–4:45

Main point

Assurance starts by separating what the model proposes from what the environment actually executes.

Speaking cues

  1. Represent a run as observations, requested actions, tool results, and updated state.
  2. Use the Universal Turing Machine comparison only as an analogy for unrestricted general computation.
  3. A finite attempt budget proves at most that the counted attempts cannot exceed the bound.
  4. Add wall-clock cancellation and explicit terminal states: accepted, failed, exhausted, or handed off.
Original source slide 3 of 22
Original source slide 3
Original source slide 4 of 22
Original source slide 4 · next

Slide 4 / 22

The “Principal-Agent” Problem in AI Automation

2:00 allocated · target 4:45–6:45

Main point

Delegation quality depends on both the task class and the workflow that monitors and limits it.

Speaking cues

  1. Name the organization as principal and the tool-using model as delegated worker.
  2. Incomplete observability raises review cost because the final diff hides much intermediate reasoning.
  3. Estimate success probability, verification effort, consequence, and reversibility by task class.
  4. Treat prompts, schemas, gates, and telemetry as different behavior-shaping or monitoring mechanisms.
Original source slide 4 of 22
Original source slide 4
Original source slide 5 of 22
Original source slide 5 · next

Slide 5 / 22

The Confused Deputy Revisited

2:30 allocated · target 6:45–9:15

Main point

Hardy (1988): a caller used the compiler’s extra permissions to overwrite a billing file they could not write themselves.

Speaking cues

  1. Setup: the compiler recorded usage statistics in (SYSX)STAT, so it had write access across SYSX.
  2. Redirection: the caller named (SYSX)BILL as debugging output. The compiler overwrote billing data using its own authority.
  3. Confusion: the caller chose the destination; the compiler supplied unrelated privileges. It mixed two sources of authority.
  4. Capability fix: use a dedicated STAT capability and a caller-provided output capability, each naming its authorized file.
Original source slide 5 of 22
Original source slide 5
Original source slide 6 of 22
Original source slide 6 · next

Slide 6 / 22

Injection Attack Taxonomy: Why Prompt Injection is Different

3:30 allocated · target 9:15–12:45

Main point

Prompt injection is an integrity problem at the language layer and an authority problem when interpreted text can cause effects.

Speaking cues

  1. SQL parameters, context-aware web encoding, and shell avoidance each protect a defined syntactic boundary.
  2. Current agents often process policy, user intent, retrieved text, and tool output through one language mechanism.
  3. AgentDojo version 3 spans 97 user tasks and 629 eligible task-goal pairs, measuring utility with attack success.
  4. CaMeL evaluates 949 expanded attacks using separated planning, quarantined processing, capabilities, and data-flow policy.
Original source slide 6 of 22
Original source slide 6
Original source slide 7 of 22
Original source slide 7 · next

Slide 7 / 22

Trust Boundary Analysis

2:30 allocated · target 12:45–15:15

Main point

Identity, content provenance, authority, and evidence lifetime answer different trust questions and must remain separate.

Speaking cues

  1. A verified maintainer can paste hostile external text; identity does not sanitize content.
  2. Treat ticket bodies, repository files, logs, and model output as evidence with provenance.
  3. Grant only the effects required for the named repository, branch, task, and time window.
  4. Recheck eligibility and bind approval to the exact candidate revision before execution.
Original source slide 7 of 22
Original source slide 7
Original source slide 8 of 22
Original source slide 8 · next

Slide 8 / 22

Case Study: Defense in Depth in Production

2:30 allocated · target 15:15–17:45

Main point

A gate should expose a versioned predicate, verdict, evidence record, and accountable owner at a named boundary.

Speaking cues

  1. Pre-gates control admission and quarantine content before the model receives a task.
  2. Post-gates bind sensitive-path, secret, identity, and ticket checks to the candidate artifact.
  3. Several veto gates compose as conjunction for acceptance, without implying independent errors or complete coverage.
  4. Detectors lower risk for configured patterns; quarantine and review limit consequences after uncertain verdicts.
Original source slide 8 of 22
Original source slide 8
Original source slide 9 of 22
Original source slide 9 · next

Slide 9 / 22

Containment Primitives: Kernel-Level Enforcement

3:00 allocated · target 17:45–20:45

Main point

Containment is a composition of controls, each mediating a specific operation under deployment assumptions.

Speaking cues

  1. Landlock restricts ambient filesystem rights, with behavior dependent on kernel support, ABI, and handled operations.
  2. Seccomp filters system calls and selected arguments, reducing kernel surface within a larger isolation design.
  3. Network namespaces force traffic through a path where destination and application policy can be applied.
  4. Test complete mediation, tamper resistance, alternate helpers, and failure behavior for the deployed composition.
Original source slide 9 of 22
Original source slide 9
Original source slide 10 of 22
Original source slide 10 · next

Slide 10 / 22

Case Study: Sandboxing in Production

2:00 allocated · target 20:45–22:45

Main point

OpenShell combines job isolation, filesystem controls, network policy, and credential routing, but each property is version-specific.

Speaking cues

  1. Public Agentic CI documentation supports an embedded gateway, Landlock controls, and endpoint policy.
  2. Current OpenShell documentation describes network namespaces, a policy proxy, seccomp, and privilege dropping.
  3. Credential handling differs by class: routed inference can retain provider keys at the host-side gateway.
  4. A denied CONNECT currently returns a structured 403, so do not narrate every denial as a silent drop.
Original source slide 10 of 22
Original source slide 10
Original source slide 11 of 22
Original source slide 11 · next

Slide 11 / 22

The Oracle Problem: Limits of Output Verification

3:30 allocated · target 22:45–26:15

Main point

Verification claims become useful only after defining the property, observation surface, enforcement power, and assumptions.

Speaking cues

  1. Rice concerns nontrivial extensional properties of arbitrary programs in a Turing-complete model.
  2. Syntactic checks, types, bounded executions, finite models, and restricted contracts can remain decidable.
  3. Safety violations have finite bad prefixes that a sufficiently powerful monitor may suppress before execution.
  4. Liveness, such as eventually producing an acceptable patch, cannot generally be forced by stopping bad actions.
Original source slide 11 of 22
Original source slide 11
Original source slide 12 of 22
Original source slide 12 · next

Slide 12 / 22

Non-Determinism in Agentic Systems

2:30 allocated · target 26:15–28:45

Main point

Safe retry requires knowledge about the external effect, not confidence that a second sample will be better.

Speaking cues

  1. CI already varies through clocks, networks, concurrency, mutable dependencies, and worker environments.
  2. Agentic CI adds variation in diagnosis and patch selection; temperature zero is not a universal reproducibility guarantee.
  3. Separate repeatable predicates, idempotent logical operations, and retries known safe after partial failure.
  4. Use stable operation keys and bind evidence to source, candidate, tool, and policy versions.
Original source slide 12 of 22
Original source slide 12
Original source slide 13 of 22
Original source slide 13 · next

Slide 13 / 22

Convergence and Divergence in Feedback Loops

2:30 allocated · target 28:45–31:15

Main point

Terminality, bounded attempts, convergence, and semantic improvement are four different properties.

Speaking cues

  1. A fixed point requires an explicit transition function whose next state equals the current state.
  2. Passing tests and approval define acceptance, but rerunning a stochastic agent may still change the patch.
  3. A decreasing retry counter proves bounded attempts, not decreasing semantic error or useful completion.
  4. Persist accepted, rejected, failed, exhausted, needs-human, and unknown states outside model prose.
Original source slide 13 of 22
Original source slide 13
Original source slide 14 of 22
Original source slide 14 · next

Slide 14 / 22

Case Study: Cycle Detection in Self-Healing CI

2:00 allocated · target 31:15–33:15

Main point

Cycle prevention requires an invariant over every trigger edge, not confidence in one label name.

Speaking cues

  1. An analyzer can create work selected by a fixer, whose failure creates new analyzer input.
  2. Applying an exclusion label at creation removes one selection edge under the current admission rule.
  3. Protect origin lineage, restrict who can change it, and recheck the predicate when the action commits.
  4. A DAG proof needs the complete graph and a rank that strictly increases along every transition.
Original source slide 14 of 22
Original source slide 14
Original source slide 15 of 22
Original source slide 15 · next

Slide 15 / 22

Action Space Reduction via Skills

2:00 allocated · target 33:15–35:15

Main point

Skills structure model behavior, while independent runtime controls determine the executable action and effect space.

Speaking cues

  1. A skill names procedure, inputs, output fields, stopping rules, and expected evidence.
  2. It can concentrate model proposals without removing a tool call that the runtime still permits.
  3. Separate possible proposals, exposed tools, state-dependent policy, and provider effects reachable through all paths.
  4. Validate referenced objects, revisions, evidence, and policy before mapping a structured verdict to authority.
Original source slide 15 of 22
Original source slide 15
Original source slide 16 of 22
Original source slide 16 · next

Slide 16 / 22

Measuring AI Agent Productivity

3:00 allocated · target 35:15–38:15

Main point

Evaluate the complete assisted workflow against a defined counterfactual, including failure and human effort.

Speaking cues

  1. Register eligible tasks before assignment; retain accepted, revised, rejected, abandoned, blocked, and unresolved outcomes.
  2. Randomize when feasible; matching alone leaves task choice, familiarity, maturity, and urgency as possible confounders.
  3. Sum model, CI, diagnosis, review, rework, and downstream costs across every attempt exactly once.
  4. Divide cohort cost by accepted outcomes, while reporting human hours and the terminal-outcome distribution separately.
Original source slide 16 of 22
Original source slide 16
Original source slide 17 of 22
Original source slide 17 · next

Slide 17 / 22

Automation Bias and Over-Reliance

2:30 allocated · target 38:15–40:45

Main point

Human review quality is an empirical outcome shaped by information order, workload, verification cost, and trust in automation.

Speaking cues

  1. Separate omission errors after missing warnings from commission errors that follow incorrect advice.
  2. Give reviewers the diff, bound revisions, commands, policy evidence, and unresolved gaps before a verdict.
  3. Test whether showing the model verdict before independent assessment changes detection or confidence calibration.
  4. Evaluate alert suppression through precision, recall, review time, and consequential defect detection.
Original source slide 17 of 22
Original source slide 17
Original source slide 18 of 22
Original source slide 18 · next

Slide 18 / 22

Human-in-the-Loop as Supervisory Control

2:30 allocated · target 40:45–43:15

Main point

Supervisory control is useful when consequence and semantic uncertainty exceed what automated evidence can justify.

Speaking cues

  1. Map repository and pipeline to plant, checks to sensors, agent to controller, and tool APIs to actuators.
  2. A supervisor may switch from the advanced controller to denial, staging, rollback preparation, or handoff.
  3. Approval becomes a hard gate only when bound to the exact head and unavoidable by the agent.
  4. Ask whether state, sensors, transition model, and safe fallback are faithful enough for the claimed envelope.
Original source slide 18 of 22
Original source slide 18
Original source slide 19 of 22
Original source slide 19 · next

Slide 19 / 22

Production Evidence at Scale

1:15 allocated · target 43:15–44:30

Main point

Operational counts establish activity and exposure, while causal benefit and safety require denominators, definitions, and detection coverage.

Speaking cues

  1. 100+ MRs per week: activity volume; acceptance, rework, and value need their own evidence.
  2. 7 workflows, 15+ projects, 5 engineers: scope and exposure in the displayed snapshot.
  3. Zero observed incidents: ask about the time window, incident definition, and detection coverage.
  4. An observed outcome does not identify which control caused it or establish future risk.
Original source slide 19 of 22
Original source slide 19
Original source slide 20 of 22
Original source slide 20 · next

Slide 20 / 22

Open Research Problems

3:30 allocated · target 44:30–48:00

Main point

Turn broad safety topics into experiments with explicit systems, adversaries, properties, and failure criteria.

Speaking cues

  1. Model typed effects and verify candidate-bound approval or at-most-one-effect properties under injected crashes.
  2. Compare injection defenses on eligible pairs, separating useful completion, prohibited effects, and text-only corruption.
  3. Audit model-proposed capability manifests against deterministic policy for excess grants and blocked legitimate work.
  4. Test ambiguous timeouts where no commit and committed-with-lost-response yield the same local observation.
Original source slide 20 of 22
Original source slide 20
Original source slide 21 of 22
Original source slide 21 · next

Slide 21 / 22

Key Takeaways

1:30 allocated · target 48:00–49:30

Main point

Reliable agentic CI comes from bounded authority, explicit state, independently checked evidence, and decision-relevant measurement.

Speaking cues

  1. Prevent confused-deputy failures by connecting every request to narrow, current authority.
  2. Combine measured resistance to hostile text with enforced limits on data and tool effects.
  3. Treat retries statistically, but retain deterministic checks for the exact predicates they encode.
  4. Expand authority only after accepted value exceeds review, rework, failure, and downstream cost.
Original source slide 21 of 22
Original source slide 21
Original source slide 22 of 22
Original source slide 22 · next

Slide 22 / 22

Questions?

6:00 allocated · target 49:30–55:30

Main point

Use questions to clarify which guarantee is behavioral, architectural, empirical, or still an open research hypothesis.

Speaking cues

  1. Second LLM? Another measured detector; shared models and data can create correlated blind spots.
  2. Read-only useful? Yes for analysis and review; grant writes only when the workflow requires them.
  3. Timeout after PR creation? Query stable operation state, then retry only with idempotency or known non-application.
  4. Strongest claim? A named broker blocks a defined finite bad prefix under stated mediation and conformance assumptions.
Original source slide 22 of 22
Original source slide 22