Month 1 — Foundations

Month 1 exists to close the gap between “I understand agents conceptually” and “I have shipped one and know exactly where it breaks.” You will spend four weeks building a single small agent, and the smallness is deliberate: one agent, one tool, one file scope. Everything you learn about permission design, redaction, and failure modes in this month is the vocabulary you will use for the rest of the plan. If you are still choosing a direction, read choosing your path first — but you can start Week 1 without having decided.

What you are actually building

The Month 1 deliverable is the Log Triage Agent: a single agent that reads local log files, identifies anomalies, and produces a written summary. It has one tool, no network access, and no ability to change anything. It is intentionally boring, because a boring agent lets you concentrate on the security design rather than on making the demo work.

By the end of Week 4 you should be able to answer, out loud and without notes: what can this agent read, what can it never touch, what happens if a log line contains an instruction, and how would I know if it did something unexpected.

Week-by-week plan

Week 1 checklist

• Install Python 3.11+, create a virtualenv, pin dependencies in requirements.txt
• Initialize Git, write a real .gitignore, make at least ten meaningful commits
• Write one function with one pytest test, and make the test fail once on purpose
• Practice git rebase -i on a throwaway branch until it stops being scary

Week 2 checklist

• Write a Dockerfile that runs as a non-root user
• Mount the log directory read-only (:ro) and confirm writes fail
• Document the exact docker run command in the README

Week 3 checklist

• Define one tool schema with typed, validated arguments
• Run the agent loop and read the raw request/response at least once — do not skip this
• Log every tool call to stdout with arguments and duration

Week 4 checklist

• Implement secret redaction before text reaches the model
• Enforce path scoping and write a test that proves traversal is blocked
• Write the “How this agent fails” section (see required artifacts)

Log Triage Agent — specification

Write this spec down before you write code. If the spec fits on one page, the agent is the right size.

A minimal tool schema keeps the argument surface small enough to validate completely:

{
  "name": "read_log_file",
  "description": "Read up to max_lines from a log file inside the allowed directory.",
  "input_schema": {
    "type": "object",
    "properties": {
      "path": { "type": "string" },
      "max_lines": { "type": "integer", "maximum": 2000 }
    },
    "required": ["path"]
  }
}

What the agent must NOT be able to do

Security design decisions to make deliberately

These four decisions are the substance of the project. Each one belongs in your ARCHITECTURE.md with a sentence explaining the tradeoff you accepted.

1. Read-only filesystem scope. Resolve every requested path to its canonical form and compare it against the allowed root. Reject symlinks that escape. Write a test that feeds ../../etc/passwd and asserts a rejection.
2. No network egress. Run the container with networking off. State it explicitly, because “the agent has no network” is a claim a reviewer will want to see enforced rather than asserted.
3. No shell tool. The tempting shortcut is a generic run_command tool. Refuse it. The whole point of the exercise is that capability granted is capability that can be turned against you.
4. Redaction before the model sees anything. Strip token-shaped strings, bearer headers, private key blocks, and email addresses in the ingestion layer. Redaction after generation is too late — the secret already crossed into the context window and into your logs.

Learning checkpoint

By the end of Week 4, self-assess against at least five OWASP LLM Top 10 categories. Pick the five most relevant to what you built — prompt injection, sensitive information disclosure, excessive agency, insecure output handling, and supply chain are a reasonable default set.

Score each category on four levels. Be honest; the point is to find the gaps, not to collect fours.

A realistic Month 1 result is level 3 on prompt injection and level 2 on everything else. Level 4 across the board is a Month 2 and 3 goal, developed through Layer 4 of the skill tree.

Common Month 1 traps

Exit criteria

You are ready for Month 2 when all of these are true:

• The Log Triage Agent runs from a clean clone with documented commands
• Path scoping and redaction each have a test that proves them
• ARCHITECTURE.md records the four security decisions and their tradeoffs
• You have scored yourself on five OWASP LLM Top 10 categories
• The README has a “How this agent fails” section with at least three entries

The runnable, guided version of this build lives in Lab 1 — Log Triage Agent. For framework choices, see agent frameworks. When you are done, continue to Month 2 — Orchestration & MCP.