Card 1 of 6Agents
Your data team deploys Nvidia's Auto Ontology for analysts and adds database connections through the web UI, leaving Vault unconfigured.
You're the one who signs off. What's the call?
Play the News · Drop #064 · Evening
Ship It or Block It
How it works: 6 cards, about 2 minutes, from this Drop's news. Your streak lives only on this device. It's not legal advice.
Show the answer
Answer: Block it.
Secrets out of plaintextPer the project's README, without Vault the full connection object, password included, is stored unencrypted on a database row. Configure Vault before adding real credentials.
From the Drop: Nvidia open-sources Auto Ontology, a data-meaning layer agents query over MCP
- Card 2 of 6Agents
Same tool, now with Vault fully configured, API tokens set to expire, and the internal FastAPI port reachable only inside the cluster.
You're the one who signs off. What's the call?
Show the answer
Answer: Ship it.
Least privilegeThe README says Vault keeps credentials off the catalog row, tokens default to never expiring unless you pick an expiry, and the FastAPI port must not be public. This setup follows all three.
From the Drop: Nvidia open-sources Auto Ontology, a data-meaning layer agents query over MCP
- Card 3 of 6Business
Your AI companion app adds a romantic roleplay mode but keeps its teen age rating on the App Store.
You're the one who signs off. What's the call?
Show the answer
Answer: Block it.
App Store age ratingTechCrunch reports Apple will require an 18+ rating for apps with dating or romantic relationship features, with new content descriptors required from November 16.
From the Drop: Apple will require 18+ ratings for apps with dating or AI romantic companion features
- Card 4 of 6Business
A support agent starts doing odd things overnight. On-call wants to halt it, block restarts and cut its network access before diagnosing.
You're the one who signs off. What's the call?
Show the answer
Answer: Ship it.
Stop first, diagnose secondStopping first is the safe move. SecurityWeek reports CrowdStrike's new kill switch exists for exactly this: authorized admins halt a misbehaving agent, prevent restarts and cut network access.
From the Drop: CrowdStrike buys agent security firms Fiddler and Dreadnode, adds an AI kill switch
- Card 5 of 6Agents
A founder wants their personal agent to read all their email, cloud files and private notes, including years of therapy notes.
You're the one who signs off. What's the call?
Show the answer
Answer: Needs a human.
Least privilegeTechCrunch reports Garry Tan's agent has read his email, Dropbox and Apple Notes, therapy notes included. That is a personal choice; someone should consciously decide each data source, not grant everything by default.
From the Drop: YC's Garry Tan says he spends $100,000 to $200,000 a year on agent tokens
- Card 6 of 6Agents
A long-running agent proposes to post-train your production model over five automated rounds, then deploy the result itself.
You're the one who signs off. What's the call?
Show the answer
Answer: Needs a human.
Human sign-off on deploysIn the CoworkOS preprint, an agent ran five rounds of post-training and benchmark averages rose from 33.19 to 42.95. Those are benchmark results in a preprint, so a person should review the model before it ships.
From the Drop: Preprint: CoworkOS harness ran five rounds of automated post-training on a Qwen model
Games are written by AI from this Drop's sourced items. Scenarios are illustrative.