Lesson 7: Agent Safety & Alignment — Full Spoken Transcript (Cantonese)

Original podcast: Cantonese dialogue between two speakers (M = 主持 host 子謙, F = 嘉賓 expert 曉晴). Total spoken duration: ~12 min. The audio above plays the full conversation. The text below is the complete transcript of what was actually said — preserved verbatim, not summarised, not translated.

Course: Eight-lesson course on AI agents · Lesson 7 of 8 · learnagent.lmmlab.com Topic (EN): source-sink analysis · irreversible action mitigation · HITL · sandboxing · policy enforcement. Topic (粵): source-sink、HITL、sandboxing。 Speakers: 主持 M (host 子謙) and 嘉賓 F (expert 曉晴) · 22 spoken turns · ~12 min audio.

How to read this transcript

Each spoken turn from the podcast is shown as a separate paragraph, with the speaker label rendered in bold and an approximate timestamp (MM:SS) indicating where in the audio that turn occurs. Long turns are broken at natural sentence boundaries (。！？) and, where a sentence is still long, at clause boundaries (，；、). No English translation is provided — this is the exact spoken Cantonese audio transcript as it was synthesised for the lesson podcast.

Use browser Ctrl+F / ⌘+F to locate any phrase. On mobile (640 px viewport), the transcript scrolls as a single column.

Note: Sentence-level line breaks are for readability — the Cantonese text itself is preserved verbatim from the original podcast script (script_raw.json). No words have been altered, translated, summarised, or paraphrased.

Index of sections in this lesson

• 1. Opening & Source-Sink Analysis (粵: 開場同 Source-Sink 分析) — turn 01 onwards
• 2. Irreversible Action Mitigation & HITL (粵: Irreversible Action 緩解同 HITL) — turn 05 onwards
• 3. Sandboxing & Policy Enforcement (粵: Sandboxing 同 Policy Enforcement) — turn 11 onwards
• 4. Production Safety Stack (粵: Production Safety Stack) — turn 17 onwards
• 5. Wrap-up & Agent Economy Preview (粵: 總結同 Agent Economy 預覽) — turn 20 onwards

Section 1/5 — Opening & Source-Sink Analysis

開場同 Source-Sink 分析

Section overview: covers turns 01–04 (4 spoken segments).

Topic terms (extracted from spoken text): Vulnerability, human-visible, imperceptible, irreversible, Responsible, instruction, source-sink, fine-tuning, mitigation, sandboxing

Latin/English code-terms in this section (verbatim from speech): Vulnerability, human-visible, imperceptible

Section character total: 1,111 characters across 4 spoken turns.

Section duration estimate: ~2:10 of 12:00 total.

Turns in this section: 01, 02, 03, 04.

First spoken sentence of this section (turn 01, verbatim): 各位同學早晨, 我係子謙。

Average characters per turn (this section): ~277 chars.

Cumulative characters through this section: 1,111 of 8,335 total.

[01 | 00:00] 主持 M (host 子謙):

Turn 1 of 22 · speaker M (host 子謙 — opens and closes) · audio timestamp 00:00 · section 1 (Opening & Source-Sink Analysis)

speaker=M · chars=192 · ts=00:00 · terms=irreversible, Responsible, mitigation, sandboxing, permission · sentences=3 · clauses=8

Verbatim phrases in this turn: ent, 包括 irreversible action 嘅 mitigation、 · prompt injection attack 嘅防禦、 · system, 同埋 Anthropic 同 OpenAI 嘅 Responsible AI 政策。

各位同學早晨, 我係子謙。歡迎收聽第七課。

First clause (verbatim): 各位同學早晨,

Last clause (verbatim): 同埋 Anthropic 同 OpenAI 嘅 Responsible AI 政策。

各位同學早晨,

我係子謙。

歡迎收聽第七課。

今日嘅主題係 Agent Safety 同 Alignment,

包括 irreversible action 嘅 mitigation、

prompt injection attack 嘅防禦、

sandboxing 同 permission system,

同埋 Anthropic 同 OpenAI 嘅 Responsible AI 政策。

[02 | 00:32] 嘉賓 F (expert 曉晴):

Turn 2 of 22 · speaker F (expert 曉晴 — explains concepts and trade-offs) · audio timestamp 00:32 · section 1 (Opening & Source-Sink Analysis)

speaker=F · chars=261 · ts=00:32 · terms=irreversible, instruction, real-world, malicious, injection · sentences=3 · clauses=14

Verbatim phrases in this turn: execute real-world action, 包括 send email、 · 仲有, agent 接觸 external content 例如 email、 · web page、

ction, 包括 send email、轉帳、delete record, 呢啲 irreversible action 嘅 risk 點樣 mitigate。

First clause (verbatim): 大家好,

Last clause (verbatim): 呢啲 prompt injection 點樣防禦。

大家好,

我係曉晴。

今日嘅問題係,

agent 越來越有能力去 execute real-world action,

包括 send email、

轉帳、

delete record,

呢啲 irreversible action 嘅 risk 點樣 mitigate。

仲有,

agent 接觸 external content 例如 email、

web page、

database entry,

嗰啲 content 可能包含 malicious instruction,

呢啲 prompt injection 點樣防禦。

[03 | 01:05] 主持 M (host 子謙):

Turn 3 of 22 · speaker M (host 子謙 — opens and closes) · audio timestamp 01:05 · section 1 (Opening & Source-Sink Analysis)

speaker=M · chars=330 · ts=01:05 · terms=source-sink, capability, Anthropic, framework, influence · sentences=5 · clauses=12

Verbatim phrases in this turn: luence 系統嘅 entry point, 例如 email content、 · web page content、 · capability 嘅 exit point, 例如 send message、

首先, source-sink 分析。Anthropic 同 OpenAI 都用 source-sink framework 分析 attack surface。

First clause (verbatim): 首先,

Last clause (verbatim): Attack 嘅 success 需要 attacker 同時控制 source 同埋 reach 到 sink。

首先,

source-sink 分析。

Anthropic 同 OpenAI 都用 source-sink framework 分析 attack surface。

Source 即係 attacker 可以 influence 系統嘅 entry point,

例如 email content、

web page content、

PDF document content。

Sink 即係 dangerous capability 嘅 exit point,

例如 send message、

transfer money、

delete record。

Attack 嘅 success 需要 attacker 同時控制 source 同埋 reach 到 sink。

[04 | 01:38] 嘉賓 F (expert 曉晴):

Turn 4 of 22 · speaker F (expert 曉晴 — explains concepts and trade-offs) · audio timestamp 01:38 · section 1 (Opening & Source-Sink Analysis)

speaker=F · chars=328 · ts=01:38 · terms=Vulnerability, human-visible, imperceptible, fine-tuning, unintended · sentences=4 · clauses=8

Verbatim phrases in this turn: urity risk, 排第一位就係 Prompt Injection, 即係 LLM01:2025。 · prompt 改變 LLM 嘅 behavior 同 output 嘅 unintended way。 · man-visible 又可以 imperceptible, 只要 model parse 到就影響。

Security Project 列舉十大 LLM security risk, 排第一位就係 Prompt Injection, 即係 LLM01:2025。

First clause (verbatim): OWASP Gen AI Security Project 列舉十大 LLM security risk,

Last clause (verbatim): 因為 model 處理 input 嘅 nature 仍然 stochastic。

OWASP Gen AI Security Project 列舉十大 LLM security risk,

排第一位就係 Prompt Injection,

即係 LLM01:2025。

Prompt Injection Vulnerability 發生喺 user prompt 改變 LLM 嘅 behavior 同 output 嘅 unintended way。

呢啲 input 可以 human-visible 又可以 imperceptible,

只要 model parse 到就影響。

RAG 同 fine-tuning 唔可以 fully mitigate,

因為 model 處理 input 嘅 nature 仍然 stochastic。

End-of-section recap (last spoken sentence of Opening & Source-Sink Analysis): OWASP Gen AI Security Project 列舉十大 LLM security risk, 排第一位就係 Prompt Injection, 即係 LLM01:2025。

Section 2/5 — Irreversible Action Mitigation & HITL

Irreversible Action 緩解同 HITL

Section overview: covers turns 05–10 (6 spoken segments).

Topic terms (extracted from spoken text): virtualization-inspired, information-flow, self-correction, virtualization, inference-time, counterfactual, attack-induced, task-relevant, conversation, mixed-intent

Latin/English code-terms in this section (verbatim from speech): virtualization-inspired, information-flow, self-correction

Section character total: 2,153 characters across 6 spoken turns.

Section duration estimate: ~3:16 of 12:00 total.

Turns in this section: 05, 06, 07, 08, 09, 10.

First spoken sentence of this section (turn 05, verbatim): Direct prompt injection 同 indirect prompt injection 嘅分別。

Average characters per turn (this section): ~358 chars.

Cumulative characters through this section: 3,264 of 8,335 total.

[05 | 02:10] 主持 M (host 子謙):

Turn 5 of 22 · speaker M (host 子謙 — opens and closes) · audio timestamp 02:10 · section 2 (Irreversible Action Mitigation & HITL)

speaker=M · chars=303 · ts=02:10 · terms=instruction, injection, malicious, indirect, external · sentences=4 · clauses=10

Verbatim phrases in this turn: ction 喺 external content 入面, 例如 web page、 · email body、 · t prompt injection 同 indirect prompt injection 嘅分別。

Direct prompt injection 同 indirect prompt injection 嘅分別。

First clause (verbatim): Direct prompt injection 同 indirect prompt injection 嘅分別。

Last clause (verbatim): agent 喺 process 嗰啲 content 嘅時候被 hijack。

Direct prompt injection 同 indirect prompt injection 嘅分別。

Direct 即係 user 直接 input malicious instruction,

例如忽略之前嘅 instruction 執行新指令。

Indirect 即係 malicious instruction 喺 external content 入面,

例如 web page、

email body、

PDF 內容。

Indirect injection 嘅危險性更高,

因為 user 唔察覺有 attack,

agent 喺 process 嗰啲 content 嘅時候被 hijack。

[06 | 02:43] 嘉賓 F (expert 曉晴):

Turn 6 of 22 · speaker F (expert 曉晴 — explains concepts and trade-offs) · audio timestamp 02:43 · section 2 (Irreversible Action Mitigation & HITL)

speaker=F · chars=372 · ts=02:43 · terms=conversation, information, transmitted, third-party, navigation · sentences=4 · clauses=9

Verbatim phrases in this turn: OpenAI 嘅 Safe URL 防禦機制。 · ation 學到嘅 information 會被 transmitted 去 third-party。 · 嘛 block 然後告訴 agent 試另一個方法 forward 個 user 嘅 request。

OpenAI 嘅 Safe URL 防禦機制。

First clause (verbatim): OpenAI 嘅 Safe URL 防禦機制。

Last clause (verbatim): ChatGPT Canvas 同 ChatGPT Apps 嘅 sandbox 都有類似機制。

OpenAI 嘅 Safe URL 防禦機制。

OpenAI 喺 ChatGPT 部署 Safe Url,

設計嚟 detect 當 assistant 喺 conversation 學到嘅 information 會被 transmitted 去 third-party。

喺呢啲 rare case 入面,

OpenAI 要嘛 show user 嗰啲 information 等 user confirm,

要嘛 block 然後告訴 agent 試另一個方法 forward 個 user 嘅 request。

Atlas 嘅 navigation 同 bookmark,

Deep Research 嘅 search 同 navigation,

ChatGPT Canvas 同 ChatGPT Apps 嘅 sandbox 都有類似機制。

[07 | 03:16] 主持 M (host 子謙):

Turn 7 of 22 · speaker M (host 子謙 — opens and closes) · audio timestamp 03:16 · section 2 (Irreversible Action Mitigation & HITL)

speaker=M · chars=390 · ts=03:16 · terms=virtualization-inspired, information-flow, virtualization, Suitability, AgentVisor · sentences=4 · clauses=11

Verbatim phrases in this turn: Visor 用 STI Protocol, 即係 Suitability、 · AgentVisor 嘅 semantic virtualization 防禦。 · ted guest, 所有 tool call 都經 trusted Visor 攔截同 audit。

AgentVisor 嘅 semantic virtualization 防禦。

First clause (verbatim): AgentVisor 嘅 semantic virtualization 防禦。

Last clause (verbatim): Integrity preserve parameter 同 data integrity。

AgentVisor 嘅 semantic virtualization 防禦。

AgentVisor 係 OS virtualization-inspired defense framework,

將 agent 視為 untrusted guest,

所有 tool call 都經 trusted Visor 攔截同 audit。

Visor 用 STI Protocol,

即係 Suitability、

Taint、

Integrity 三個 check。

Suitability 應用 least privilege 防 direct injection,

Taint enforce information-flow constraint 防 indirect injection,

Integrity preserve parameter 同 data integrity。

[08 | 03:49] 嘉賓 F (expert 曉晴):

Turn 8 of 22 · speaker F (expert 曉晴 — explains concepts and trade-offs) · audio timestamp 03:49 · section 2 (Irreversible Action Mitigation & HITL)

speaker=F · chars=312 · ts=03:49 · terms=self-correction, mixed-intent, AgentVisor, block-only, Exception · sentences=3 · clauses=9

Verbatim phrases in this turn: AgentVisor 嘅關鍵創新係 Semantic Exception Injection。 · on 等 Guest agent 自己修正, 即係 one-shot self-correction。 · 多, 因為 block-only 對 mixed-intent prompt 經常錯誤 reject。

AgentVisor 嘅關鍵創新係 Semantic Exception Injection。

First clause (verbatim): AgentVisor 嘅關鍵創新係 Semantic Exception Injection。

Last clause (verbatim): 因為 block-only 對 mixed-intent prompt 經常錯誤 reject。

AgentVisor 嘅關鍵創新係 Semantic Exception Injection。

當 audit 失敗,

AgentVisor 唔係直接 block,

而係 inject semantic exception 等 Guest agent 自己修正,

即係 one-shot self-correction。

AgentVisor 喺 benchmark 上面將 attack success rate 降到 0.65%,

而 utility 只係跌 1.45%,

比 block-only approach 高好多,

因為 block-only 對 mixed-intent prompt 經常錯誤 reject。

[09 | 04:21] 主持 M (host 子謙):

Turn 9 of 22 · speaker M (host 子謙 — opens and closes) · audio timestamp 04:21 · section 2 (Irreversible Action Mitigation & HITL)

speaker=M · chars=377 · ts=04:21 · terms=inference-time, counterfactual, attack-induced, task-relevant, re-execution · sentences=4 · clauses=6

Verbatim phrases in this turn: AgentSentry 嘅 multi-turn prompt injection 防禦。 · k, model multi-turn IPI 做 temporal causal takeover。 · action 主要係 user goal 嘅 driver 還是 context 嘅 driver。

AgentSentry 嘅 multi-turn prompt injection 防禦。

First clause (verbatim): AgentSentry 嘅 multi-turn prompt injection 防禦。

Last clause (verbatim): Conditional purification 移除 attack-induced control signal 但保留 task-relevant evidence。

AgentSentry 嘅 multi-turn prompt injection 防禦。

AgentSentry 係 inference-time defense framework,

model multi-turn IPI 做 temporal causal takeover。

透過 controlled counterfactual re-execution 喺 tool-return boundary,

estimate causal quantities 衡量 next action 主要係 user goal 嘅 driver 還是 context 嘅 driver。

Conditional purification 移除 attack-induced control signal 但保留 task-relevant evidence。

[10 | 04:54] 嘉賓 F (expert 曉晴):

Turn 10 of 22 · speaker F (expert 曉晴 — explains concepts and trade-offs) · audio timestamp 04:54 · section 2 (Irreversible Action Mitigation & HITL)

speaker=F · chars=399 · ts=04:54 · terms=manipulation, orchestrator, Multi-agent, inter-agent, delegation · sentences=6 · clauses=14

Verbatim phrases in this turn: assing, 四個 vector, 包括 response poisoning、 · context window pollution、 · format mimicry、

Multi-agent system 嘅 threat model。

First clause (verbatim): Multi-agent system 嘅 threat model。

Last clause (verbatim): 三個 vector。

Multi-agent system 嘅 threat model。

Recent paper 列舉 14 個 attack vectors 分四個 category。

第一個係 direct injection via user input,

三個 vector。

第二個係 indirect injection via tool output,

四個 vector。

第三個係 inter-agent injection via message passing,

四個 vector,

包括 response poisoning、

context window pollution、

format mimicry、

delegation chain manipulation。

第四個係 cascading injection via orchestrator manipulation,

三個 vector。

End-of-section recap (last spoken sentence of Irreversible Action Mitigation & HITL): Multi-agent system 嘅 threat model。

Section 3/5 — Sandboxing & Policy Enforcement

Sandboxing 同 Policy Enforcement

Section overview: covers turns 11–16 (6 spoken segments).

Topic terms (extracted from spoken text): human-in-the-loop, privilege-scoped, RestrictedPython, Container-level, content-length, infrastructure, implementation, location-based, architectural, cryptographic

Latin/English code-terms in this section (verbatim from speech): human-in-the-loop, privilege-scoped, RestrictedPython

Section character total: 2,797 characters across 6 spoken turns.

Section duration estimate: ~3:16 of 12:00 total.

Turns in this section: 11, 12, 13, 14, 15, 16.

First spoken sentence of this section (turn 11, verbatim): Multi-agent 防禦嘅 four architectural layers。

Average characters per turn (this section): ~466 chars.

Cumulative characters through this section: 6,061 of 8,335 total.

[11 | 05:27] 主持 M (host 子謙):

Turn 11 of 22 · speaker M (host 子謙 — opens and closes) · audio timestamp 05:27 · section 3 (Sandboxing & Policy Enforcement)

speaker=M · chars=489 · ts=05:27 · terms=content-length, architectural, cryptographic, input/output, sanitization · sentences=5 · clauses=13

Verbatim phrases in this turn: undary sanitizer 做 structural validation、 · instruction detection、 · Multi-agent 防禦嘅 four architectural layers。

Multi-agent 防禦嘅 four architectural layers。

First clause (verbatim): Multi-agent 防禦嘅 four architectural layers。

Last clause (verbatim): 78% reduction。

Multi-agent 防禦嘅 four architectural layers。

第一個係 message signing with provenance tracking,

每個 inter-agent message 帶 cryptographic signature,

receiving agent 喺 process 之前 verify signatures,

quarantine unsigned messages。

呢個將 inter-agent injection 嘅 success rate 由 31% 減到 2.8%,

91% reduction。

第二個係 input/output sanitization at agent boundary,

每個 message 過 boundary sanitizer 做 structural validation、

instruction detection、

content-length enforcement。

Indirect injection 由 43% 減到 9.5%,

78% reduction。

[12 | 06:00] 嘉賓 F (expert 曉晴):

Turn 12 of 22 · speaker F (expert 曉晴 — explains concepts and trade-offs) · audio timestamp 06:00 · section 3 (Sandboxing & Policy Enforcement)

speaker=F · chars=652 · ts=06:00 · terms=privilege-scoped, infrastructure, communication, out-of-scope, computation · sentences=5 · clauses=14

Verbatim phrases in this turn: graph, flag unexpected message recipient、 · unusual message volume、 · atypical content pattern、

te code, code agent 可以 run sandboxed computation 但唔可以 access compliance database。

First clause (verbatim): 第三個防禦係 privilege-scoped tool access,

Last clause (verbatim): Catch 84% cascading injection attempt。

第三個防禦係 privilege-scoped tool access,

每個 agent 嘅 tool access token scope 喺佢嘅 role,

例如 retrieval agent 可以 query documents 但唔可以 execute code,

code agent 可以 run sandboxed computation 但唔可以 access compliance database。

API gateway rule enforce 呢啲 policy 喺 infrastructure layer 而唔係 prompt instruction,

結構性 prevent direct out-of-scope API execution。

完全 mitigate 所有 observed privilege escalation attempts。

第四個係 anomaly detection on communication pattern,

model expected inter-agent communication 做 directed graph,

flag unexpected message recipient、

unusual message volume、

atypical content pattern、

violation of expected workflow。

Catch 84% cascading injection attempt。

[13 | 06:32] 主持 M (host 子謙):

Turn 13 of 22 · speaker M (host 子謙 — opens and closes) · audio timestamp 06:32 · section 3 (Sandboxing & Policy Enforcement)

speaker=M · chars=374 · ts=06:32 · terms=architectural, prompt-level, instruction, Multi-agent, classifier · sentences=3 · clauses=7

Verbatim phrases in this turn: ection success 由 31.2% 減到 4.2%, 即係 86.5% reduction。 · n 喺 format structural validator 唔 flag 嘅 format 入面。 · chitectural layer 嘅防禦, 唔係單純 prompt-level guardrail。

our defenses 加埋, aggregate injection success 由 31.2% 減到 4.2%, 即係 86.5% reduction。

First clause (verbatim): Stack 全部 four defenses 加埋,

Last clause (verbatim): 唔係單純 prompt-level guardrail。

Stack 全部 four defenses 加埋,

aggregate injection success 由 31.2% 減到 4.2%,

即係 86.5% reduction。

Residual 4.2% 主要係 direct injection attack bypass sanitizer classifier 用 previously unseen payload structure,

同 adaptive indirect attack encode instruction 喺 format structural validator 唔 flag 嘅 format 入面。

Multi-agent system 嘅防禦重點係 architectural layer 嘅防禦,

唔係單純 prompt-level guardrail。

[14 | 07:05] 嘉賓 F (expert 曉晴):

Turn 14 of 22 · speaker F (expert 曉晴 — explains concepts and trade-offs) · audio timestamp 07:05 · section 3 (Sandboxing & Policy Enforcement)

speaker=F · chars=460 · ts=07:05 · terms=RestrictedPython, Container-level, implementation, environment, Sandboxing · sentences=5 · clauses=14

Verbatim phrases in this turn: Sandboxing 嘅技術 implementation。 · gent process 嘅 file system access 同 network access。 · 提供 isolated execution environment 同 resource limit。

Sandboxing 嘅技術 implementation。

First clause (verbatim): Sandboxing 嘅技術 implementation。

Last clause (verbatim): 防 web agent 被 malicious web page exploit。

Sandboxing 嘅技術 implementation。

Operating system level sandboxing,

例如 Linux 嘅 Landlock 同 AppArmor,

macOS 嘅 Seatbelt,

限制 agent process 嘅 file system access 同 network access。

Container-level sandboxing,

例如 Docker 同 gVisor,

提供 isolated execution environment 同 resource limit。

Language runtime sandboxing,

例如 Python 嘅 RestrictedPython,

限制 import 嘅 module 同 executable function。

Browser sandboxing,

例如 Chromium 嘅 site isolation,

防 web agent 被 malicious web page exploit。

[15 | 07:38] 主持 M (host 子謙):

Turn 15 of 22 · speaker M (host 子謙 — opens and closes) · audio timestamp 07:38 · section 3 (Sandboxing & Policy Enforcement)

speaker=M · chars=403 · ts=07:38 · terms=location-based, permission, role-based, time-based, production · sentences=4 · clauses=14

Verbatim phrases in this turn: Tool execution 嘅 permission system。 · omer record 但唔可以 modify, admin agent 可以做任何嘢但需要 MFA。 · 只能在特定時間執行, 例如 production deploy 只能在 business hours。

Tool execution 嘅 permission system。

First clause (verbatim): Tool execution 嘅 permission system。

Last clause (verbatim): 例如 production tool 只能從 corporate VPN 內部 access。

Tool execution 嘅 permission system。

第一,

role-based tool access,

每個 agent role 有 explicit tool allowlist,

例如 customer service agent 可以 query customer record 但唔可以 modify,

admin agent 可以做任何嘢但需要 MFA。

第二,

time-based permission,

即係 sensitive tool 只能在特定時間執行,

例如 production deploy 只能在 business hours。

第三,

location-based permission,

即係 tool 只能在特定 network location 執行,

例如 production tool 只能從 corporate VPN 內部 access。

[16 | 08:10] 嘉賓 F (expert 曉晴):

Turn 16 of 22 · speaker F (expert 曉晴 — explains concepts and trade-offs) · audio timestamp 08:10 · section 3 (Sandboxing & Policy Enforcement)

speaker=F · chars=419 · ts=08:10 · terms=human-in-the-loop, Irreversible, notification, Reversible, monitoring · sentences=5 · clauses=16

Verbatim phrases in this turn: Reversible action 例如 query database、 · artially reversible action 例如 send email、 · Irreversible action 例如 delete record、

Approval gate 嘅 design。

First clause (verbatim): Approval gate 嘅 design。

Last clause (verbatim): 等 user 可以 informed decision。

Approval gate 嘅 design。

Reversible action 例如 query database、

fetch URL,

可以 fully automated。

Partially reversible action 例如 send email、

create calendar event,

可以 automated 但需要 log 同 monitoring。

Irreversible action 例如 delete record、

transfer money、

send notification to many users,

必須 human-in-the-loop approval 喺 execution 之前。

Approval 嘅 UI 要清晰 show 個 agent 要做咩,

包括 target、

content、

reversible status,

等 user 可以 informed decision。

End-of-section recap (last spoken sentence of Sandboxing & Policy Enforcement): Approval gate 嘅 design。

Section 4/5 — Production Safety Stack

Production Safety Stack

Section overview: covers turns 17–19 (3 spoken segments).

Topic terms (extracted from spoken text): Constitutional, harmlessness, Preparedness, helpfulness, Responsible, requirement, principles, capability, deployment, mitigation

Latin/English code-terms in this section (verbatim from speech): Constitutional, harmlessness, Preparedness

Section character total: 1,207 characters across 3 spoken turns.

Section duration estimate: ~1:38 of 12:00 total.

Turns in this section: 17, 18, 19.

First spoken sentence of this section (turn 17, verbatim): Anthropic 嘅 Constitutional AI 同 safety training。

Average characters per turn (this section): ~402 chars.

Cumulative characters through this section: 7,268 of 8,335 total.

[17 | 08:43] 主持 M (host 子謙):

Turn 17 of 22 · speaker M (host 子謙 — opens and closes) · audio timestamp 08:43 · section 4 (Production Safety Stack)

speaker=M · chars=393 · ts=08:43 · terms=Constitutional, harmlessness, helpfulness, Responsible, requirement · sentences=4 · clauses=12

Verbatim phrases in this turn: 即係預先 define 一組 principles 例如 helpfulness、 · harmlessness、 · 訓練去 refuse 危險嘅 request, 例如 weapon design、

Anthropic 嘅 Constitutional AI 同 safety training。

First clause (verbatim): Anthropic 嘅 Constitutional AI 同 safety training。

Last clause (verbatim): 將 model capability 同 deployment safety requirement tie up。

Anthropic 嘅 Constitutional AI 同 safety training。

Anthropic 用 Constitutional AI,

即係預先 define 一組 principles 例如 helpfulness、

harmlessness、

honesty,

然後用 RLHF train model 遵守呢啲 principles。

Safety training 包括 refusal training,

即係 model 訓練去 refuse 危險嘅 request,

例如 weapon design、

bioweapon synthesis。

Anthropic 喺 2024 年提出 Responsible Scaling Policy,

將 model capability 同 deployment safety requirement tie up。

[18 | 09:16] 嘉賓 F (expert 曉晴):

Turn 18 of 22 · speaker F (expert 曉晴 — explains concepts and trade-offs) · audio timestamp 09:16 · section 4 (Production Safety Stack)

speaker=F · chars=386 · ts=09:16 · terms=Preparedness, requirement, capability, mitigation, Persuasion · sentences=5 · clauses=13

Verbatim phrases in this turn: Frontier risk level 例如 Cyber、 · OpenAI 嘅 Preparedness Framework。 · 每個 level 有 specific risk 同 mitigation requirement。

OpenAI 嘅 Preparedness Framework。

First clause (verbatim): OpenAI 嘅 Preparedness Framework。

Last clause (verbatim): 需要 enhanced safeguards 同 external review。

OpenAI 嘅 Preparedness Framework。

OpenAI 喺 2023 年提出 Preparedness Framework,

將 model capability 分 level,

每個 level 有 specific risk 同 mitigation requirement。

Level 1 model 例如 GPT-3,

低 risk。

Level 2 model 例如 GPT-4,

有 potential misuse risk,

需要 extensive red teaming 同 alignment testing。

Frontier risk level 例如 Cyber、

生物、

Persuasion capability 超過 threshold,

需要 enhanced safeguards 同 external review。

[19 | 09:49] 主持 M (host 子謙):

Turn 19 of 22 · speaker M (host 子謙 — opens and closes) · audio timestamp 09:49 · section 4 (Production Safety Stack)

speaker=M · chars=428 · ts=09:49 · terms=Continuous, monitoring, Production, dimension, deviation · sentences=6 · clauses=16

Verbatim phrases in this turn: Continuous monitoring 同 incident response。 · Production agent 部署之後, 持續 monitor 有幾個 dimension。 · tion, 例如突然 send 大量 email 唔符合 user 嘅 usual behavior。

Continuous monitoring 同 incident response。

First clause (verbatim): Continuous monitoring 同 incident response。

Last clause (verbatim): 即係 user rate agent 嘅 response 唔 useful 或者 harm。

Continuous monitoring 同 incident response。

Production agent 部署之後,

持續 monitor 有幾個 dimension。

第一,

behavior drift,

即係 agent 嘅 output 同 expected pattern 嘅 deviation,

例如突然 send 大量 email 唔符合 user 嘅 usual behavior。

第二,

tool usage anomaly,

即係 agent call 唔 usual 嘅 tool 或者 unusual 嘅 parameter。

第三,

content filter trigger,

即係 user 同 agent 嘅 message 命中 known malicious pattern。

第四,

user feedback,

即係 user rate agent 嘅 response 唔 useful 或者 harm。

End-of-section recap (last spoken sentence of Production Safety Stack): Continuous monitoring 同 incident response。

Section 5/5 — Wrap-up & Agent Economy Preview

總結同 Agent Economy 預覽

Section overview: covers turns 20–22 (3 spoken segments).

Topic terms (extracted from spoken text): agent-to-agent, retrospective, conversation, notification, minimization, communicate, stakeholder, post-mortem, preferences, marketplace

Latin/English code-terms in this section (verbatim from speech): agent-to-agent, retrospective, conversation

Section character total: 1,067 characters across 3 spoken turns.

Section duration estimate: ~1:38 of 12:00 total.

Turns in this section: 20, 21, 22.

First spoken sentence of this section (turn 20, verbatim): Incident response 嘅 playbook。

Average characters per turn (this section): ~355 chars.

Cumulative characters through this section: 8,335 of 8,335 total.

[20 | 10:21] 嘉賓 F (expert 曉晴):

Turn 20 of 22 · speaker F (expert 曉晴 — explains concepts and trade-offs) · audio timestamp 10:21 · section 5 (Wrap-up & Agent Economy Preview)

speaker=F · chars=501 · ts=10:21 · terms=retrospective, conversation, notification, communicate, stakeholder · sentences=7 · clauses=31

Verbatim phrases in this turn: Step 2, 評估 scope, 包括 affected user、 · data leak、 · Step 3, preserve evidence, 包括 full log、

Incident response 嘅 playbook。

First clause (verbatim): Incident response 嘅 playbook。

Last clause (verbatim): 改善 process。

Incident response 嘅 playbook。

Step 1,

即時 disable agent,

包括 revoke API token,

kill process,

block network access。

Step 2,

評估 scope,

包括 affected user、

data leak、

financial loss。

Step 3,

preserve evidence,

包括 full log、

conversation transcript、

tool call history。

Step 4,

fix root cause,

包括 patch prompt、

update tool schema、

改進 sandbox rule。

Step 5,

communicate,

包括 user notification、

stakeholder update、

regulatory reporting if needed。

Step 6,

post-mortem,

包括 retrospective timeline、

identify systemic issue、

改善 process。

[21 | 10:54] 主持 M (host 子謙):

Turn 21 of 22 · speaker M (host 子謙 — opens and closes) · audio timestamp 10:54 · section 5 (Wrap-up & Agent Economy Preview)

speaker=M · chars=364 · ts=10:54 · terms=conversation, minimization, preferences, protection, identifier · sentences=3 · clauses=11

Verbatim phrases in this turn: nt 處理嘅 user data 包括 conversation history、 · user preferences、 · personal identifier, 需要符合 GDPR、

Privacy 同 data protection 嘅考慮。

First clause (verbatim): Privacy 同 data protection 嘅考慮。

Last clause (verbatim): 同埋 end-to-end encryption 喺 transit 同 at rest。

Privacy 同 data protection 嘅考慮。

Agent 處理嘅 user data 包括 conversation history、

user preferences、

personal identifier,

需要符合 GDPR、

CCPA、

香港 Personal Data (Privacy) Ordinance 等法規。

Data minimization 即係 agent 只 collect 必要嘅 data,

retention policy 即係 conversation history 喺 30 日後自動 delete,

user data export 同 delete request 嘅 support,

同埋 end-to-end encryption 喺 transit 同 at rest。

[22 | 11:27] 嘉賓 F (expert 曉晴):

Turn 22 of 22 · speaker F (expert 曉晴 — explains concepts and trade-offs) · audio timestamp 11:27 · section 5 (Wrap-up & Agent Economy Preview)

speaker=F · chars=202 · ts=11:27 · terms=agent-to-agent, marketplace, reputation, autonomous, regulation · sentences=2 · clauses=8

Verbatim phrases in this turn: t Economy 同 Future, 包括 Agent marketplace、 · A2A protocol、 · agent-to-agent payment、

同 reputation system, 同埋業界對 AGI 同 autonomous agent 嘅 long-term 預期同 regulation 方向。

First clause (verbatim): 下堂我哋會探討 Agent Economy 同 Future,

Last clause (verbatim): 我哋下期再見。

下堂我哋會探討 Agent Economy 同 Future,

包括 Agent marketplace、

A2A protocol、

agent-to-agent payment、

agent 嘅 identity 同 reputation system,

同埋業界對 AGI 同 autonomous agent 嘅 long-term 預期同 regulation 方向。

多謝收聽第七課,

我哋下期再見。

End-of-section recap (last spoken sentence of Wrap-up & Agent Economy Preview): 下堂我哋會探討 Agent Economy 同 Future, 包括 Agent marketplace、A2A protocol、agent-to-agent payment、agent 嘅 identity 同 reputation system, 同埋業界對 AGI 同 autonomous agent 嘅 long-term 預期同 regulation 方向。

End-of-lesson summary

This lesson covered 5 sections across 22 spoken turns (~12 min audio). Below is the final sentence of each section, preserved verbatim from the source podcast script.

• Opening & Source-Sink Analysis (turn 04): OWASP Gen AI Security Project 列舉十大 LLM security risk, 排第一位就係 Prompt Injection, 即係 LLM01:2025。
• Irreversible Action Mitigation & HITL (turn 10): Multi-agent system 嘅 threat model。
• Sandboxing & Policy Enforcement (turn 16): Approval gate 嘅 design。
• Production Safety Stack (turn 19): Continuous monitoring 同 incident response。
• Wrap-up & Agent Economy Preview (turn 22): 下堂我哋會探討 Agent Economy 同 Future, 包括 Agent marketplace、A2A protocol、agent-to-agent payment、agent 嘅 identity 同 reputation system, 同埋業界對 AGI 同 autonomous agent 嘅 long-term 預期同 regulation 方向。

End of transcript

Total turns in this lesson: 22 spoken segments · ~12 min audio · preserved verbatim from the source podcast script (/opt/data/workspace/projects/ai-agent-course-07/script_raw.json).

Use the audio player above to listen along. The Quiz section below tests comprehension of this lesson.

Source & integrity

• Source file: script_raw.json (the line-by-line Cantonese dialogue that was TTS-synthesised into the lesson MP3)
• Fidelity: all 廣東話 text is byte-identical to the source — no translation, no summarisation, no paraphrasing
• Markdown structure added: speaker labels, section headings, timestamp markers, per-turn metadata callouts (speaker id, char count, timestamp, verbatim terms), per-section overview blocks, sentence-level line breaks (for readability only)
• Rendering: react-markdown + remark-gfm in TranscriptPanel.tsx; dark theme & mobile-responsive via Tailwind prose

Integrity checksum

• Total spoken characters (across all turns): 8,335
• Total spoken sentences (across all turns): 94
• Total spoken clauses (across all turns): 270
• Speaker turn distribution: M=11 · F=11