Paperclip explained: an operating layer for teams of AI agents
Paperclip security and operations: treat agents as workers with access
Review identity, workspaces, secrets and incident handling together.
What you will learn
- Identity is part of deployment
- Agent work can touch real systems
- Prepare for a stopped or compromised run
Before you start
- Node.js and agent runtime basics
- A test company with non-sensitive tasks
Turn the source review into a bounded experiment with stop conditions.
Key takeaways
- Local trusted mode is not a shared security mode.
- Secrets and tool permissions shape the real blast radius.
- Incident drills must be run, not inferred from source.
Identity is part of deployment
The documented authenticated mode requires login, while local_trusted does not. Confirm board membership and agent API-key scope before exposing the service to a team.
A board-claim URL grants ownership during migration. Protect it as a one-time credential and retain an audit record of who claimed it.
Agent work can touch real systems
Adapters may run in workspaces and receive secrets. Limit filesystem and network access, provide short-lived credentials where possible and require review before publishing or paying.
A prompt inside a work item can request actions outside the original goal. The operator needs tool permissions and human approval in addition to a written policy.
Prepare for a stopped or compromised run
Monitor queued work, orphaned runs, budget incidents and approval backlog. Rehearse pausing an agent and revoking its credentials.
The README describes recovery and auditing, but this review did not test incident response. Run the drill on your installation and preserve the evidence.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Verify membership and unauthenticated denial.
- 2
Inspect a sample agent workspace and injected secrets.
- 3
Pause an agent, revoke access and examine the audit trail.
Copy-ready example
Operator check: login denied / company scope / secret scope / pause path / audit recordFrequently asked questions
Does an approval gate sanitize malicious input?
No. It creates a human decision point; tool isolation and input review are still needed.
Is company isolation verified by this article?
No. The repo describes it, but no cross-company runtime test was executed.
Sources
- Paperclip / README.mdSource checked 2026-09-26
- Paperclip / docs/deploy/deployment-modes.mdSource checked 2026-09-26
- Paperclip / server/src/services/approvals.tsSource checked 2026-09-26
- Paperclip / server/src/services/budgets.tsSource checked 2026-09-26