When Not to Trust AI with Root: Guardrails for AI-Driven Ops

Prompt injection is not theoretical — an agent that reads nginx access logs is reading text chosen by anyone on the internet. A User-Agent header can contain instructions. If the agent can turn what it reads into commands it runs, an attacker can too.

Confidence is not a signal — models state a wrong flag in the same tone as a right one. The guardrails below never depend on the model knowing when it is wrong.

Group access is read-only power — membership in adm or systemd-journal lets the agent read logs, which is most of what diagnosis needs. RHEL has no adm-readable /var/log/messages by default, so on RHEL rely on the journal group.

Logs contain secrets too — connection strings, bearer tokens and session IDs end up in application logs. Decide whether those logs may leave the host before pointing a cloud-hosted model at them.

Check file modes — the readable-files check above often finds world-readable .env files. Fix them with mode 600 or 640 and a proper owner; the file permissions calculator helps pick the mode.

Paths differ by distribution — ss is /usr/bin/ss on Debian and Ubuntu and /usr/sbin/ss on RHEL and Fedora. sudoers matches the full path, so check with command -v on each host family.

log_output — records everything the commands print, under /var/log/sudo-io. List sessions with sudo sudoreplay -l user ai-agent and replay one by its ID.

Wrap complex reads in a script — if a diagnostic needs several commands, put them in a root-owned script in /usr/local/sbin with mode 755 and grant only that script. The script is reviewed once; its arguments never come from the model.

restrict — disables port, agent and X11 forwarding and PTY allocation in one keyword (OpenSSH 7.2 and later). With command=, sshd never executes what the client asked for; it only hands that string to the gate.

No eval, ever — the character check rejects shell metacharacters, and the command is split into an array and executed directly. Using eval or bash -c "$cmd" here would undo the whole design.

Anchored patterns — every regex is anchored with ^ and $, and arguments like the line count are bounded. A pattern such as ^journalctl would allow journalctl --vacuum-time=1s.

Harden the key — see our SSH security guide for from= source restrictions and sshd settings, and the SSH key setup tool to generate a dedicated key for the agent.

One host first — apply an approved change to a single canary host, verify, then roll out. Agents are fast enough to break a whole fleet before the first alert fires.

Never let it touch the guardrails — sudoers, sshd_config, auditd rules, SELinux or AppArmor state, and the gate script itself must be outside anything the agent can change, even with approval. A model asked to fix a denial will try to remove the control that caused it.

Runbooks beat improvisation — if a change is routine, write it down once as a reviewed script or runbook and let the agent choose when to propose it. Our guide to AI-generated runbooks covers how to keep those accurate.

auid survives sudo — the audit login UID is set at SSH login and is not changed by sudo, so commands the agent runs as root still carry its auid and match the rule.

Ship logs off the host — an agent that can delete its own audit trail has no audit trail. Forward the journal and audit logs to a central collector the agent cannot reach.

Locking the password is not enough — passwd -l does not stop SSH key logins. An expired account (usermod --expiredate 1) is refused by sshd through PAM account checks, and removing the key from authorized_keys is the most direct option.

Practise the stop — test the kill switch before you need it, the same way you test backups. If you are dealing with an agent that has already done damage, our incident response guide covers triage.