Separate AI Planner and Runner Processes to Prevent Unauthorized System Access

Security-focused developers are urging teams to split AI agent workflows into three distinct processes — planner, gate, and runner — each with strictly limited privileges and no shared sockets. The concern is that most current generation loops collapse these roles into one, allowing a language model's output to flow unchecked into remote shell commands on the host machine. Without this architectural separation, a model acting as both planner and executor can reach live credentials, SSH keys, and system files as if it were a trusted operator. The recommended approach involves defining a frozen contract in version control that specifies allowed file paths, permitted commands, maximum diff size, and a rollback path before any model call is made. Each process should receive only the inputs it strictly needs, with the gate layer accepting or rejecting proposed changes purely on machine-readable rules, never by invoking the model again.