Key Takeaways
- • Two Sigma has deployed AI agents for every employee operating under each user's full identity and permissions rather than separate machine identities, representing a departure from conventional enterprise security architecture.
- • The firm solved critical technical challenges through two innovations: a trace-header propagation system that attributes every agent action to the originating human, and replacement of direct web access with Google's Web Grounding for Enterprise, a cached index served within the firm's VPC.
- • The architectural approach eliminates external egress vectors that typically fuel prompt-injection and data-exfiltration risks, while avoiding permission drift, licensing duplication, and system incompatibilities inherent in the conventional "shoe and shoe-agent" model.
- • Two Sigma's implementation, completed in 2025, represents a practitioner's framework for regulated enterprises evaluating agentic AI adoption as cloud agents transition from experimental infrastructure to production deployment.
- • The solution preserves expected value while maintaining attributability and safety controls critical for a 25-year-old quantitative hedge fund operating in a regulated environment.
Summary
Two Sigma, the established quantitative hedge fund, has completed a full deployment of AI agents across its workforce, making a counterintuitive architectural choice that runs each agent under an employee's own identity rather than a separate machine service account. According to Shu Fang, an engineer at the firm speaking on the AI Engineer podcast, this approach departs significantly from conventional enterprise practice, where agents typically operate under isolated machine identities to contain risk. The firm's decision reflects a calculated judgment that full-identity agents, when properly controlled, deliver superior risk-adjusted outcomes compared to cautious architectural alternatives.
The implementation addressed two fundamental technical problems that arise in conventional agent architectures. First, traditional "shoe and shoe-agent" models created permission drift, licensing duplication, and system incompatibilities that proved operationally untenable. Two Sigma solved this through a trace-header propagation system that ensures complete attributability—every action taken by an AI agent is traceable back to the specific human employee whose identity it operates under. Second, the firm replaced direct web access with Google's Web Grounding for Enterprise, a cached index served entirely within Two Sigma's virtual private cloud, eliminating the external data egress vector that typically creates vulnerability to prompt-injection attacks and data-exfiltration risks.
The architectural framework, completed in 2025, maintains security and accountability within a regulated financial services context by ensuring that agents cannot operate as untethered entities independent of human oversight. The trace-header system preserves attribution while the elimination of external web access removes a primary attack surface. This approach allows agents to operate with full user permissions—accessing the same systems and data as their human counterparts—while maintaining the control structures necessary for a hedge fund managing significant capital and operating under regulatory requirements.
Fang's presentation serves as a practitioner's blueprint for regulated enterprises evaluating agentic AI adoption at a critical inflection point when cloud agents are transitioning from experimental deployments to production infrastructure. Two Sigma's solution demonstrates that full-identity agents need not be untethered liabilities when designed with proper attribution and network isolation, offering a potential model as financial services firms and other regulated entities navigate the deployment of autonomous AI systems within their operations.
The implementation addressed two fundamental technical problems that arise in conventional agent architectures. First, traditional "shoe and shoe-agent" models created permission drift, licensing duplication, and system incompatibilities that proved operationally untenable. Two Sigma solved this through a trace-header propagation system that ensures complete attributability—every action taken by an AI agent is traceable back to the specific human employee whose identity it operates under. Second, the firm replaced direct web access with Google's Web Grounding for Enterprise, a cached index served entirely within Two Sigma's virtual private cloud, eliminating the external data egress vector that typically creates vulnerability to prompt-injection attacks and data-exfiltration risks.
The architectural framework, completed in 2025, maintains security and accountability within a regulated financial services context by ensuring that agents cannot operate as untethered entities independent of human oversight. The trace-header system preserves attribution while the elimination of external web access removes a primary attack surface. This approach allows agents to operate with full user permissions—accessing the same systems and data as their human counterparts—while maintaining the control structures necessary for a hedge fund managing significant capital and operating under regulatory requirements.
Fang's presentation serves as a practitioner's blueprint for regulated enterprises evaluating agentic AI adoption at a critical inflection point when cloud agents are transitioning from experimental deployments to production infrastructure. Two Sigma's solution demonstrates that full-identity agents need not be untethered liabilities when designed with proper attribution and network isolation, offering a potential model as financial services firms and other regulated entities navigate the deployment of autonomous AI systems within their operations.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.