Shu Fang

Shu Fang works on enterprise agent infrastructure: giving software an employee’s access while keeping its actions traceable and its use of external information controlled. In “Tethered: Our Agents Are Us”, where he was credited with a Two Sigma affiliation, he described how he and his colleagues built remote agents that run under employees’ identities. His account explains the infrastructure and tradeoffs behind that deployment; it does not establish sole authorship or a broader career history.

Moving agents into the cloud under employee identities

The project began with the limits of local coding agents. They offered powerful automation, but execution remained tied to an employee’s computer and often required comfort with a command-line interface. The team wanted employees to interact with remote agents through Slack, browsers, and mobile devices. Moving execution into the cloud made identity a central design decision: which permissions would those agents carry?

Separate agent accounts proved cumbersome. Their permissions had to stay synchronized with the employee’s, software could require additional licenses, and applications such as Google Workspace complicated access to the same email or underlying data through two identities. Fang’s team instead adopted agents running under employee identities, preserving existing access while adding controls for attribution and web use.

Two Sigma already had much of the necessary computing infrastructure. Automated jobs, code containers, and research notebooks ran in per-user Kubernetes namespaces across regions. The agent framework extended that arrangement: a controller requested compute resources, and a sidecar retrieved the employee identity from a separate identity service and made it available to the containers. The team shipped a managed fleet of remote agents while also allowing employees to build and deploy agents into their own namespaces. An agent intended for wider company use still needed the security and production-support arrangements expected of other applications.

Tracing agent actions and controlling web access

Sharing an identity solved access problems but made human and automated actions harder to distinguish. Fang described propagating an agent-attribution header through requests and downstream systems, using HTTP clients, Model Context Protocol integrations, skills, and agent harnesses to maintain it. Like a distributed trace ID, the header could connect successive operations into end-to-end action provenance, helping reconstruct the chain that produced an outcome. It supplemented authentication rather than replacing it: the authenticated identity established whose access was being used, while the propagated header helped explain the agent’s involvement. Fang emphasized that a separate agent account alone would not provide that downstream history.

Web access posed another set of risks. Agents needed current information, but unrestricted search and fetch could expose sensitive data, introduce malicious content or prompt injection, and create problems around licensed material. The team used controlled web grounding through Google’s Web Grounding for Enterprise, which Fang described as providing search and fetch within existing VPC and network controls. They blocked direct external access and disabled native web-search and fetch tools in agent harnesses, routing requests through approved integrations instead.

That choice traded immediacy for control. Fang reported that the index was generally fresh within 24 hours, or six hours for more frequently updated sites, at the time he had checked. He considered that sufficient for most of their agent use cases. He also acknowledged that the service’s content curation could fail. His argument was that these measures reduced risk while preserving useful access to information; they did not establish immunity to prompt injection.

Improving configuration and seeking greater model control

• Session-informed configuration: Fang also described using session behavior to improve agent configuration. Actual usage could reveal which tools or settings would help an employee more effectively than a job title alone. He paired that goal with efforts to restrict access to individual sessions, which could contain sensitive or privileged information, rather than making everyone’s agent activity broadly visible across the firm.
• Self-managed models: In the talk’s discussion, Fang expressed a personal preference for moving more inference toward self-managed models as open-weight capabilities improve. He cited cost, model deprecations, and behavioral changes following frontier-model releases as reasons to seek greater control. This was a direction he advocated, not an announced company-wide transition. The same practical judgment shaped his account of remote agents: existing enterprise infrastructure could support powerful delegation, provided the team addressed how actions were traced, information was accessed, and shared applications were supported.