What if the network was the sandbox? — Remy Guercio, Tailscale
Source: YouTube · AI Engineer · published Jun 1, 2026 · 24:21
Tailscale's Aperture is an AI gateway that shifts LLM access control from API keys to network-layer identity, ensuring agents in sandboxes have no keys to exfiltrate while providing full visibility into tool calls, costs, and usage.
Key Takeaways:
• Traditional sandbox permissions rely on API keys that can be exfiltrated or OAuth credentials stored inside the sandbox, both creating security risks 01:15
• Aperture uses WireGuard-based network identity to grant access based on user, group, or tag—no API key exists inside the sandbox at all 05:30
• Operating at the network layer guarantees visibility into every tool call, enabling cost controls, cross-provider quotas, and webhook integrations that agents cannot bypass 11:00
• The underlying identity primitives are available open-source via TS net, letting teams build custom internal MCP servers or gateways with the same network-level auth 16:45
By moving authentication and authorization to the network layer, Aperture gives developers easy LLM access while giving security teams comprehensive observability—without relying on keys that live inside sandboxes.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[music] >> Yeah, hi everybody. >> [laughter] >> Thanks for joining. I know we're a little late starting. So, um yeah, I appreciate it. Uh yeah, I'm happy to um excited to talk about uh kind of a both a question that I kind of want to pose and kind of want to, you know, think about. Uh and then I'll just do a demo of something that uh basically what you can do. Uh a project that we're working on and building uh that you can do if you start to think about the network uh as more of a sandbox environment rather than, you know, just necessarily the network. So, um yeah, I mean just kind of starting by asking the question, what are the components of a sandbox, right? You know, so I know I say that. You've probably all thought of different things. You probably all thought of probably a VM or a co…