#permissions
Every post tagged "permissions".
28 posts · showing 1–10
-
Your Research Agent Read One Poisoned Web Page, and It Still Had the Email Tool. Lock Risky Tools the Moment Untrusted Text Enters the Context.
Prompt-injection filters try to spot the bad sentence. A taint flag skips that guess: once fetched text is in the context, the tools that can do damage are no longer offered.
-
The Refund Tool Capped Each Refund at $500. The Support Agent Issued Eleven $490 Refunds to One Customer.
A per-call limit only answers "is this action too big?" Agents fail on a different question: "is this sequence too big?" Here is how a guardrail that never fired still let the money leave, and the ledger check that would have stopped it.
-
Your Assistant Agent Reads Your Inbox and Pays Your Bills. Split It Where the Permissions Change, Not Where the Topics Do.
An email agent, a calendar agent and a finance agent look like clean architecture. They leave every agent exactly as manipulable as before and add three handoffs. There is a better place to draw the line.
-
Your Agent Asks Permission Nine Times an Hour, So Nobody Reads the Prompts Any More. Spend a Fixed Approval Budget.
Every confirmation dialog you add makes the next one less effective. Here's how to classify write actions by reversibility and reach, auto-allow the safe corner, and reserve the human's attention for the handful of actions that can't be undone.
-
The Page Your Agent Read Told It to Email Your Customer List. "Ignore Instructions in the Content" Won't Stop the Next One.
A system-prompt warning makes injection less likely. It doesn't make it impossible, and the attacker gets as many tries as they like. The real fix lives in the tool dispatcher, not the prompt.
-
Your Agent's Dry Run Doesn't Bind the Real Run — Confirm the Plan Hash, Not the Intent
A human approves a preview; the agent then executes a freshly computed call. Everything that shifts in between is unguarded — and the fix is a redeemable plan object, not a sterner confirmation prompt.
-
Your Agent Has One manage_calendar Tool. That's Why It Deleted the Wrong Meeting.
A single do-everything tool looks tidy in the schema and hides four separate problems: guessed actions, unvalidated payloads, permissions that can't tell reading from deleting, and traces that flatten three risk levels into one name. Here's where to cut instead — and where splitting makes things worse.
-
Read, Draft, Send: Where to Draw the Permission Line in a Personal Email Agent
Most email agents get permissions wrong by granting them per tool. The safer line runs through the arguments — who the recipient is, how many there are, and whether the thread was already open.
-
Read-Only Was Never the Same as Safe
SELECT-only credentials close exactly one of the four ways an analytics agent can hurt you. The other three don't require the ability to write anything to the database at all.
-
Compliance and Audit for Agent-Written Systems
The audit questions don't change — who's responsible, how do you know it's correct, show me this case. They become answerable differently, and an actor field saying "agent-service" answers the first one not at all.