AlpacaX

Use case · On our own infrastructure

Let agents do risky work, but only what a person approved

On our own server, an agent investigated a full disk on its own. In this cleanup, deletes and changes ran only inside sessions a person approved; anything outside a session's scope was refused or sent to a person.

old backup archives deleted, every one from a list a person approved
363
investigation first, then the reviewed plan, each step in its own session
5sessions
commands recorded across the five sessions
147

With Alpacon: a scoped work session

An AI agent requests a work session through Alpacon. A person approves the cleanup plan; Alpacon checks and records commands on the server at 98% disk, and off-plan work is refused or sent to a person.AI agentClaude Code, Codex,and others, on alaptop or in CI1Eunyoung Jeong, CEO, approvesthe plan2Alpaconwork-session gateway3Command record5Your infrastructureWork session1 server · the reviewed cleanupplan · changes only afterapprovalServer at 98% diskOn-prem data centerApproveddeletion list(363 files)4Cloud VPCWeb server, DatabaseKubernetes clusterNode, NodeOff the plan: refused or sent to a personAn AI agent requests a work session through Alpacon. A person approves the cleanup plan; Alpacon checks and records commands on the server at 98% disk, and off-plan work is refused or sent to a person.AI agentClaude Code, Codex, and others, on alaptop or in CI1Alpaconwork-session gateway3Eunyoung Jeong,CEO, approves theplan25Command record4Your infrastructureWork session1 server · the reviewed cleanup plan ·changes only after approvalServer at 98% diskOn-prem data centerApproved deletionlist (363 files)Cloud VPCWeb server, DatabaseKubernetes clusterNode, NodeOff the plan: refused or sent to a person
  1. Request a work session: servers, job, time limit
  2. A person approves
  3. Each command is checked against the session
  4. It runs on the in-scope servers
  5. Commands in the session are recorded
Illustrative layout. In this case the session covered one server.

What happened: root filesystem at 98%

  1. 0 min

    Investigation first

    What is filling the disk?

    An urgent session for one read-only diagnostic.

  2. 53 min

    Investigation first

    Full inventory

    61 read-only commands in 14 minutes. A cleanup plan drafted.

  3. Same day

    Approved by a person

    The plan, in phases

    Eunyoung Jeong, our CEO and the server's owner, approved the cleanup plan. The agent ran it in approved sessions.

  4. Day 4

    Approved session

    The approved list

    The agent checked every path against the list, then deleted 363 files.

  5. Every step

    Commands recorded

    One record

    Commands and file transfers, each tied to the session it ran in.

Who did what, hour by hour

Scroll to see the full timeline →

Hour by hour over day 1 and day 4: 147 agent commands above; below, two investigation sessions, then approved sessions for the reviewed cleanup plan, then an approved session that deleted the 363 files on the list and made follow-up fixes.AGENTwhat it ranALPACONwhat it enforced0h1h2h3h4h5h6h7hDay 1, hours after the first diagnosticDay 4one diagnosticinventory: 61 commandsruns the reviewed plan in phasesdeletes the 363 on the listinvestigation sessionsplan reviewed →approved sessions run the plan■ file transferred, recordedapproved: the 363, then fixes
Each tick is one command from the session records, drawn to scale; the gap between day 1 and day 4 is omitted. Any agent that can run a CLI uses the same path.

The same pattern runs our most sensitive changes. When we rolled out our secrets cluster, each step ran in its own scoped session, and Choongbum Park, who leads our infrastructure, approved each of the five sessions before it ran: 41 commands.

Our agents' work sessions since June 2026

We run our own infrastructure on Alpacon

work sessions our agents opened
457
commands recorded
4,675
commands refused before they ran
78
median session: access for one job, then it ends
2.3 min

FAQ

Can the agent delete something nobody approved?

In this cleanup, deletes and changes ran only inside sessions a person approved. Anything outside a session's scope was refused or sent to a person. Across our own use, 78 commands were refused before they ran.

Do I have to approve every command?

No. A person approves the session and its scope. Routine commands inside it run without asking; anything outside it is refused or sent to a person.

What do I show an auditor?

The session record: its purpose, that it was approved, and the commands with their results.

Playbook: disk emergency, approved cleanup

See it on your servers

  1. Investigation, then plan
  2. Inventory
  3. Reviewed plan
  4. Delete only the approved list

On our own infrastructure, October–November 2026. Times from the Alpacon session records.