219 East LLC

Security

Security at 219 East LLC

219 East LLC designs, builds, and operates AI systems for its own practice and for clients. Security is owned by the LLC's principal, who is accountable for the security of every system the LLC ships and who advises security leadership on AI agent risk on request.

Security lead

Name
Duane Grey
Title
Chief Executive Member, 219 East LLC
Security role
Security lead, accountable for the LLC's security function
Team
One person. The principal is the security function.
Scope
Every application, agent, data pipeline, and hosted service 219 East LLC designs, builds, or operates, for its own practice and for client engagements.
Security contact
[email protected]

What the security function covers

The LLC builds software that puts language models in front of real data and real tools. The security work follows that surface, from agent architecture down to the HTTP layer.

AI agent security architecture

Designs that assume the model can be manipulated. Trust labels that travel with content from its source, delimited handling of untrusted input, separation of the agent that plans from the code that acts, and human approval for actions influenced by untrusted content.

Written engineering standards

A maintained set of security standards applied to every project: authentication patterns by caller type, authorization enforced in the data layer, credential rotation procedures, security headers, CORS, rate limiting, payload limits, input validation, and audit logging.

Supply chain and dependencies

Vulnerability scanning at the close of each working session per the LLC's standard, waivers that carry an expiry and a reason, registry signature verification, and a defined wait window for upgrades that separates runtime security patches from routine updates.

Adversarial review and monitoring

Published attack research is run against the LLC's own agent designs as it appears. Review targets the defect classes that ordinary testing does not surface, and agent activity is designed to be monitored and audited.

Advisory work for security leadership

In 2026 Duane Grey was asked by a Chief Information Security Officer to brief that CISO's security organization on the risks of deploying AI agents against sensitive data. He prepared a written security briefing for the CISO's security leads and provided the advisory service to the organization. Client names and details are kept confidential.

The briefing was built around the questions a security organization works through when agents move from pilot into regulated environments. It covered seven areas:

  1. Threat economicsHow AI changes the cost of attack and defense, and the questions about authority and data access that follow from it.
  2. Models on regulated groundWhen smaller, locally hosted models are a fit for data that cannot leave the building, and the hardware realities of running them.
  3. Oversight and monitoringWhat current research shows about AI systems monitoring other AI agents, and where that oversight breaks down.
  4. Off-the-shelf agents and sensitive dataThe gap between consumer and enterprise agents, blast radius, and treating prompts with the same discipline as code.
  5. Building the trust boundaryContent trust labeling, a layered architecture for an agent whose reasoning cannot be trusted, and integrity of the agent's plan.
  6. Open questionsThe risk model for agents that learn and consolidate memory from experience.
  7. Projects worth buildingCandidate security projects for the organization, each paired with the decision gates a security team would apply before approving it.

Published security work

Duane Grey publishes his security research and analysis at duanegrey.com. Each piece below is public and dated.

Insights

Quick takes

Reporting a security issue

To report a vulnerability in a system built or operated by 219 East LLC, or to discuss a security engagement, write to [email protected]. Reports go directly to the security lead.