Source: https://internal-agents.com/agents/figma-security-agent

# Figma — Security alert triage and investigation agents

Figma's security engineering team assembled an alert-response system from commercial parts rather than writing an agent framework: agent loops run inside Tines workflow automation on Claude models, and retrieval runs on AWS Bedrock Knowledge Bases and Amazon Kendra. Figma built the layers around them, including the Lambda handlers that index every Panther SIEM alert, intent routing to specialized agents, the scoped tool contracts, and the memory stores. A tagged Slack bot triages the alert with Okta, endpoint, Wiz, Slack, and Panther tools, delegates deeper questions to a sub-agent that writes Snowflake SQL against the security data lake, and can open pull requests against the detections repo or the monorepo.

- Company: [Figma](https://internal-agents.com/organizations/figma)
- Collection: Agents
- Approach type: Agent family
- Deployment stage: Deployed
- Autonomy: Drafts reviewed
- Evidence strength: Detailed primary
- Status: Internal
- First reported year: 2026
- Work: Security, On-call, Coding
- Interfaces: Slack, Github, Webhook
- Invocation: Event-driven, Interactive
- Entry reviewed: 2026-09-21

## Purpose

### Summary

Figma's security engineering team assembled an alert-response system from commercial parts rather than writing an agent framework: agent loops run inside Tines workflow automation on Claude models, and retrieval runs on AWS Bedrock Knowledge Bases and Amazon Kendra. Figma built the layers around them, including the Lambda handlers that index every Panther SIEM alert, intent routing to specialized agents, the scoped tool contracts, and the memory stores. A tagged Slack bot triages the alert with Okta, endpoint, Wiz, Slack, and Panther tools, delegates deeper questions to a sub-agent that writes Snowflake SQL against the security data lake, and can open pull requests against the detections repo or the monorepo.

Fact · Reported · High confidence · `figma-security-agent--summary`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 28, 32, 100-104

Representative workflow: Panther alert through retrieval precedent, intent routing, scoped-tool investigation, and a draft pull request the on-call engineer reviews.

## How it works

### Index the alert and retrieve precedent

A Lambda handler converts each Panther alert into a standardized document with structured attributes and indexes it into Kendra; the next similar alert queries Bedrock for semantic matches, biased toward recent alerts and alerts carrying on-call investigation context

Fact · Reported · High confidence · `figma-security-agent--primitives-1`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 32, 38, 46-48

### Post a first-pass summary and tag the bot

The Lambda stream handler posts the alert to Slack with the first-pass LLM summary and similar-alert references, then auto-tags the Tines Security Slackbot in the thread; on-call engineers can also tag the bot manually to ask follow-up questions

Fact · Reported · High confidence · `figma-security-agent--primitives-2`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 102

### Route the request by intent

The tag fires a webhook into Tines, where a lighter model reads the full Slack thread and classifies the request as alert triage, a platform security question, an app approval inquiry, or something else, and routes it to a specialized agent with its own scoped tool inventory, authorization layer, and system prompt

Fact · Reported · High confidence · `figma-security-agent--primitives-3`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 104

### Investigate with scoped tools

The alert triage agent pulls the actor's Okta profile and access, checks endpoint rules and events in Workshop, checks cloud findings in Wiz, reads linked Slack threads for past reasoning, and retrieves raw Panther events

Fact · Reported · High confidence · `figma-security-agent--primitives-4`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 110-119

### Delegate data-lake questions to the investigation sub-agent

For questions the direct tools cannot answer, the triage agent passes a natural-language query to a sub-agent that writes and runs Snowflake SQL against the Panther data warehouse, which ingests AWS CloudTrail, Okta system logs, GitHub audit events, GCP audit logs, osquery endpoint telemetry, Workshop and Santa events, Wiz findings, and about a hundred other tables

Fact · Reported · High confidence · `figma-security-agent--primitives-5`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 121, 127-129

### Open a draft pull request for the fix

Detection rule, allowlist, and suppression changes go to the Panther detections repo, and infrastructure, service config, Terraform, RBAC, and IdP changes go to the monorepo; the agent picks up reviewer comments through a GitHub webhook, can respond or make further changes, and can rebase stale branches onto the latest master

Fact · Reported · High confidence · `figma-security-agent--primitives-7`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 176, 180

## Where people stay involved

- **Panther alert in a Slack thread → agent investigation and evidence chain → on-call engineer confirms or corrects** — Work-product review · Level 3
- **confirmed finding → agent-authored detection, suppression, or configuration change → draft pull request review** — Work-product review · Level 3
- **alert matching a high-confidence benign or duplicate precedent → automatic severity downgrade before anyone is paged** — Exception-only · Level 5
- **platform security question or endpoint software approval inquiry routed to a non-triage agent** — Unknown · Level unknown

**Reported:** Four workflows have different boundaries. The on-call engineer reviews what the triage agent found; remediation returns as a pull request that a deterministic post-step forces to draft, so the agent can open a pull request but the post never says it merges or deploys; high-confidence benign or duplicate alerts are downgraded before anyone is paged; and the post documents no review step for the non-triage intents.

### Supervision evidence

#### Operating model assessment

Level 3 for Panther alert in a Slack thread → agent investigation and evidence chain → on-call engineer confirms or corrects; human attention boundary: work-product-review.

Inference · Catalog judgment · High confidence · `figma-security-agent--operating-models-0`

Confidence reason: The post states that the on-call engineer's job shifted to reviewing what the agent found and confirming or correcting it, which locates human attention at the investigation write-up rather than during it.

Qualifications:

- Observation date: 2026-07

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 210

#### Operating model assessment

Level 3 for confirmed finding → agent-authored detection, suppression, or configuration change → draft pull request review; human attention boundary: work-product-review.

Inference · Catalog judgment · High confidence · `figma-security-agent--operating-models-1`

Confidence reason: The post says the agent opens pull requests and that a deterministic post-step sets every one of them to draft, so the review of the change is the documented boundary. Opening a pull request is the agent's authority; nothing in the post says the agent merges or deploys.

Qualifications:

- Observation date: 2026-07

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 176, 184

#### Operating model assessment

Level 5 for alert matching a high-confidence benign or duplicate precedent → automatic severity downgrade before anyone is paged; human attention boundary: exception-only.

Inference · Catalog judgment · Medium confidence · `figma-security-agent--operating-models-2`

Confidence reason: The severity-downgrade code path runs on a retrieval confidence score without a described human checkpoint, and Figma credits it with fewer on-call pages. The post does not say what happens to a downgraded alert afterwards, so the exception boundary is inferred from the reduced paging rather than stated.

Qualifications:

- Observation date: 2026-07

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 84-94

#### Operating model assessment

Unclassified for platform security question or endpoint software approval inquiry routed to a non-triage agent; human attention boundary: unknown.

Inference · Catalog judgment · Unverified confidence · `figma-security-agent--operating-models-3`

Confidence reason: The post names platform security questions and app approval inquiries as separate routed agents with their own tools and prompts, but describes no review step for their answers. The boundary is undocumented, and the triage boundary must not be assumed to carry over.

Qualifications:

- Observation date: 2026-07

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 104

## Implementation details

### Harness

Agent loops run inside Tines, a commercial workflow-automation product, which supplies the LLM loop and the explicit tool interfaces; Figma built the surrounding system: AWS Lambda handlers that index and post each Panther alert, a retrieval layer on AWS Bedrock Knowledge Bases and Amazon Kendra, webhook-triggered intent routing to specialized agents, the deterministic tool-calling contracts, and the memory stores. The core tool set is managed outside any individual agent as configuration-as-code.

Fact · Reported · High confidence · `figma-security-agent--architecture-harness`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 32, 100-104, 205

### Model

Claude models, named by tier rather than by version. A lighter model such as Claude Sonnet performs intent routing and memory formatting; a model such as Claude Opus runs the alert triage agent and the Panther investigation sub-agent.

Fact · Reported · High confidence · `figma-security-agent--architecture-model`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 104, 110, 127, 158

### Interfaces

slack, github, webhook

Fact · Reported · High confidence · `figma-security-agent--architecture-interfaces`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 102, 104, 180

### Tool access

Each routed agent has its own scoped tool inventory and authorization layer. The alert triage agent's tools cover Okta profiles, groups, and login history; North Pole Security Workshop rule and event search, host sync status, and rule push for the Santa endpoint agent; Wiz audit logs, inventory, findings, and exposed resources; Slack thread reads, profile lookups, and progress updates; Panther alert details, raw triggering events, and related alerts; opening pull requests in the Panther detections repo or the monorepo; and delegation to the Panther investigation sub-agent.

Fact · Reported · High confidence · `figma-security-agent--architecture-tool-access`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 104, 112-121

### Knowledge

Case memory is the Kendra and Bedrock corpus of past alerts plus investigation context, which is the comment an on-call engineer leaves in the Slack alert thread or the Asana ticket and which is indexed back onto the original alert. Retrieval is biased toward recent alerts and alerts that carry investigation context. The investigation sub-agent keeps a separate procedural memory store organized by data-source tags such as aws, okta, osquery, and workshop, holding schema findings written by a lighter model. Tines database records hold stateful objects such as open agent-created pull requests and Panther investigation state.

Fact · Reported · High confidence · `figma-security-agent--architecture-knowledge`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 46-48, 137, 149, 151

### Credentials

Authorization controls limit the agents to security team members, and Figma states that the agent works on behalf of an authorized team member and that its tools are scoped, authorized, and monitored. Pull requests the agent opens are authored by a service account, so the PR description carries the requesting engineer's name and a link to the originating Slack thread. The post does not document how the agent authenticates to each connected system.

Fact · Reported · High confidence · `figma-security-agent--architecture-credentials`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 178, 186, 206

### Context management

The triage agent receives the full Slack thread history plus its steering-memory markdown document, loaded into context at the start of every run. It has no ambient access to whole Slack channels, and outside direct messages it can read a thread only when it is re-tagged on the latest message.

Fact · Reported · High confidence · `figma-security-agent--architecture-context-mgmt`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 110, 139, 188

### Alert-to-resolution loop

Panther alert → retrieval summary and precedent → intent routing → scoped-tool investigation → draft pull request

Fact · Reported · High confidence · `figma-security-agent--primitives-0`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 28

### Segment memory by precedent, policy, state, and schema

Case memory holds past alerts and investigation context, steering memory holds behavioral rules the agent can update when an engineer corrects it, Tines database records hold stateful objects, and the sub-agent's tagged procedural memory holds schema findings it saves after a discovery query

Fact · Reported · High confidence · `figma-security-agent--primitives-6`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 135-151

### Implementation coverage

- **Model:** reported — The post names Claude Sonnet and Claude Opus as examples of the tier used at each step, hedged as "a model like"; no version is given.
- **Harness:** reported
- **Sandbox:** unreported — Tines runs the agent loops and the sub-agent executes SQL against Snowflake, but no execution isolation boundary is described; the legacy unknown claim stays in research details.
- **Tool access:** reported
- **Knowledge:** reported
- **Context management:** reported
- **Credentials:** reported — Authorization scoping, the service-account pull-request identity, and the on-behalf-of rule are stated; the authentication mechanism for each connected system is not.
- **Interfaces:** reported — Alert summaries also reach Asana tickets and investigation context is indexed from them, but Asana is not an interface value in the schema.

## Validation and failure handling

### Enforce deterministic tool-call safeguards

Every pull request the agent creates is set to draft by a deterministic post-step in the Tines workflow rather than by a prompt instruction, and the same tool-calling contract keeps sensitive employee information out of Okta responses and stops the agent closing or modifying pull requests it did not author

Fact · Reported · High confidence · `figma-security-agent--primitives-8`

Confidence reason: A linked first-party source states the claim.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 184-186

## Reported observations

Observation: Cost latency · Estimate · Time-to-resolution on complex security alerts handled by the agent system

### Headline claim

Around 70% reduction in time-to-resolution on complex alerts, reported by Figma in July 2026

Metric · Reported · Medium confidence · `figma-security-agent--headline-metric`

Confidence reason: Figma reports the figure in its own engineering blog with no measurement method, denominator, or interval, and hedges it as "around 70%". The page also states the result two ways: the standfirst says time-to-resolution was cut by 71% with no scope, while the body says around 70% on complex alerts. This record keeps the body wording because it is the more precise and more bounded of the two.

Qualifications:

- The source does not report the denominator of this figure.
- Reported by: Figma
- Scope: Time-to-resolution on complex security alerts handled by the agent system
- Observation date: 2026-07

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 212 (Where we are now, and what's next)
- Contextualizes · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Article standfirst under the title, which states the same result as cutting time-to-resolution by 71% and omits the complex-alerts scope; the standfirst is outside the preserved capture and was read on the live page on 2026-09-21

Observation: Cost latency · Reported measurement · On-call pages after automatic severity downgrading of high-confidence benign or duplicate alerts

### Key observation

Figma reports a 20% drop in on-call pages from automatically downgrading the severity of alerts the retrieval layer scored as high-confidence benign or duplicate

Metric · Reported · Medium confidence · `figma-security-agent--key-metrics-0`

Confidence reason: Figma attributes the drop to the automatic severity downgrade alone and repeats it in the results paragraph, but reports no baseline period, denominator, or method. The downgrade runs in the retrieval layer on a confidence threshold, not in the triage agent.

Qualifications:

- The source does not report the denominator of this figure.
- Reported by: Figma
- Scope: On-call pages, after automatically downgrading high or critical alerts scored as high-confidence benign or duplicate
- Observation date: 2026-07

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 84-94, 212

Observation: Cost latency · Reported measurement · Endpoint software approval requests reaching the security team

### Key observation

Figma reports 25% fewer endpoint software approval requests, which it attributes to the agent detecting when a user is asking about a tool and directing them to comparable approved alternatives

Metric · Reported · Medium confidence · `figma-security-agent--key-metrics-1`

Confidence reason: The figure appears only in the summary list of results, with the mechanism Figma credits for it but no baseline, denominator, or method.

Qualifications:

- The source does not report the denominator of this figure.
- Reported by: Figma
- Scope: Endpoint software approval requests reaching the security team
- Observation date: 2026-07

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 212

Observation: Effectiveness · Qualitative · On-call engineer confidence in resolution quality

### Key observation

Figma reports meaningfully higher on-call engineer confidence in resolution quality, which it attributes to the agent's evidence chain being explicit and reviewable; no measurement is given

Metric · Reported · Low confidence · `figma-security-agent--key-metrics-2`

Confidence reason: Figma states engineer confidence is meaningfully higher but gives no survey, scale, or other measurement, so this is a qualitative impression reported alongside the numeric results.

Qualifications:

- The source does not report the denominator of this figure.
- Reported by: Figma
- Scope: On-call engineer confidence in resolution quality
- Observation date: 2026-07

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 212

Observation: Cost latency · Qualitative · Queries the investigation sub-agent needed for one repeated data-lake question before and after saving a schema memory

### Key observation

Figma reports that the first question the investigation sub-agent was asked about Zoom activity needed multiple schema-discovery queries, and that the same question cost a single query after the sub-agent saved a procedural memory

Metric · Reported · Medium confidence · `figma-security-agent--key-metrics-3`

Confidence reason: The before-and-after query counts come from one worked example about Zoom activity that Figma uses to illustrate procedural memory; the post says the pattern repeated across data sources but gives no aggregate.

Qualifications:

- The source does not report the denominator of this figure.
- Reported by: Figma
- Scope: Queries the investigation sub-agent needed for one repeated data-lake question, before and after it saved a schema memory
- Observation date: 2026-07

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 158

Observation: Adoption output · Qualitative · Share of initial security response work the system handles for Figma's security team

### Key observation

Figma states the system handles all initial security response work for the security team, and that the on-call engineer's job shifted from investigating from scratch to reviewing what the agent found

Metric · Reported · Medium confidence · `figma-security-agent--key-metrics-4`

Confidence reason: Figma states the coverage directly, but gives no alert counts, exclusions, or period, so the scope of "all initial security response work" rests on the team's own characterization.

Qualifications:

- The source does not report the denominator of this figure.
- Reported by: Figma
- Scope: Initial security response work for Figma's security team
- Observation date: 2026-07

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 210

## Lessons

### Lesson

Figma separates precedent from policy across memory layers, after saving everything as steering memory started overriding the agent's behavior in unwanted ways; a one-off lesson about a specific alert type goes into retrieval investigation context, and a behavioral rule that should change how the agent approaches all alerts goes into steering memory.

Fact · Reported · High confidence · `figma-security-agent--lessons-learned-0`

Confidence reason: The memory section states the split and names the early mistake of saving everything as steering memory, including the consequence it produced.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 147

### Lesson

Figma's security team says procedural memory should have been in the system from the start, because the investigation sub-agent's self-built schema memory was a late addition whose improvement was dramatic enough that the earlier work feels wasted in retrospect.

Opinion · Reported · Medium confidence · `figma-security-agent--lessons-learned-1`

Confidence reason: This is the team's own hindsight preference in the "In hindsight" list. The underlying improvement is illustrated by one example and a general claim that the pattern repeated, not by measured results across data sources.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 204

### Lesson

Figma manages its core agent tool set in configuration-as-code outside any individual agent, after team members iterating quickly produced divergent copies of the same core agent with different tool configurations.

Fact · Reported · High confidence · `figma-security-agent--lessons-learned-2`

Confidence reason: The hindsight list states both the fragmentation problem and the configuration-as-code arrangement Figma runs today.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 205

### Lesson

Figma enforces controls as deterministic post-steps in the Tines workflow rather than as prompt instructions, after finding that relying on the model to remember an instruction such as always creating a pull request as a draft was not reliable enough.

Fact · Reported · High confidence · `figma-security-agent--lessons-learned-3`

Confidence reason: The guardrails section states that the draft setting is a deterministic post-step in the Tines workflow and gives the reliability failure that led to it.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 184

### Lesson

Figma includes the requesting security engineer's name and a link to the originating Slack thread in every agent-authored pull request, because bot-authored pull requests make git blame point at a service account; the team says it should have done this from the start.

Fact · Reported · High confidence · `figma-security-agent--lessons-learned-4`

Confidence reason: The code-changes section states the practice, the git blame reason behind it, and the team's view that it should have been there from the start.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 178

### Lesson

Figma's security team says it is more comfortable with agent autonomy when the action is bounded, reversible, and supported by clear evidence than when it is broad, destructive, or hard to audit, and that read-heavy investigation, duplicate detection, precedent retrieval, and draft remediation fit agentic execution better than generic high-powered write paths.

Opinion · Reported · Medium confidence · `figma-security-agent--lessons-learned-5`

Confidence reason: This is Figma's stated comfort boundary for autonomy, not a measured finding, and it is bounded to the action types this security workflow performs.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 190

### Lesson

Figma's security team advises designing the Slack trust model for public channels up front rather than bolting it on, because user-activity detail that is fine in a private security thread becomes a problem in a channel with a hundred people; Figma handles this with channel-aware prompt design and other deterministic controls.

Opinion · Reported · Medium confidence · `figma-security-agent--lessons-learned-6`

Confidence reason: The hindsight list gives this as advice from Figma's experience with a Slack-integrated security agent, with the controls Figma uses; the post reports no incident that tested them.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, line 206

## Reviewed legacy details

### Sandbox

unknown

Inference · Catalog judgment · Medium confidence · `figma-security-agent--architecture-sandbox`

Confidence reason: The post places the agent loops in Tines and has the sub-agent execute SQL against Snowflake, but documents no execution isolation boundary for agent-run code; unknown does not mean absent.

Evidence:

- Supports · [1] [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/) · [Preserved copy](https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md) · Preserved content.md, lines 100, 121

## Question coverage and scope

- **purpose:** Reported
- **workflow:** Reported — The alert-to-resolution loop and the memory layers are mechanisms that support the run rather than steps in it, and the deterministic safeguards are recorded under validation.
- **human involvement:** Reported — Four workflows have different boundaries. The on-call engineer reviews what the triage agent found; remediation returns as a pull request that a deterministic post-step forces to draft, so the agent can open a pull request but the post never says it merges or deploys; high-confidence benign or duplicate alerts are downgraded before anyone is paged; and the post documents no review step for the non-triage intents.
- **implementation:** Reported
- **validation:** Reported — What is documented is deterministic tool-call safeguards and pull-request review. Figma names better evaluation of agent conclusions as future work, so no evaluation harness or accuracy check is reported.
- **observations:** Reported
- **lessons:** Reported

## Sources

1. [How we secure Figma's internal systems with agents](https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/)
   - Engineering blog · First party · Evidence
   - Original URL: <https://www.figma.com/blog/how-we-secure-figmas-internal-systems-with-agents/>
   - Publisher: Figma · Published: 2026-07-29 · Accessed: 2026-09-21 · Last verified: 2026-09-21
   - Preserved copy in the repository: <https://github.com/steel-experiments/internal-agents-map/blob/main/archive/sources/figma-security-agent-source-1/content.md>