#permissions
Every post tagged "permissions".
28 posts · showing 21–28
-
OAuth for Agents: Acting on Behalf of a User
A service account with everyone's access puts your entire access-control model inside a model's judgment. Per-user tokens move the check to where prompt injection can't reach it.
-
Sandboxing Code Execution: What a `run_code` Tool Actually Needs
One tool replaces dozens — and hands a model that reads untrusted text a general-purpose mechanism for doing anything the process can do. Four boundaries, four isolation levels, and the one people leave open.
-
MCP: What a Standard Tool Protocol Changes, and What It Doesn't
Portable integrations and runtime discovery are real wins. Tool design, selection accuracy, permissions, and untrusted content are exactly as hard as before — and easy connection quietly makes two of them worse.
-
Specialist Agents or Specialist Prompts? The Cheaper Half of Multi-Agent
A separate agent buys separate context, separate permissions, and separate lifecycles. It does not buy expertise — that's what prompts are for, and they cost nothing and lose nothing at the boundary.
-
Indirect Prompt Injection: When the Tool Result Is the Attack
The attack doesn't come from your user — it comes from the page, ticket, or document your agent fetched. Three conditions have to hold for it to work, and breaking any one is an architectural choice, not a prompt.
-
Where to Put the Approval: Human-in-the-Loop Is a Design, Not a Checkbox
A confirm dialog nobody reads has all the latency of oversight and none of the protection. Four placements, a routing rule based on reversibility, and the metric that tells you your gate has become a rubber stamp.
-
The Read-Only Agent That Wasn't: Auditing What Your Tools Can Actually Reach
A tool named `check_service_health` woke someone at 3am. Read-only is a claim about effects at the far end of every call, and there's a short audit that either proves it or shows you what you actually deployed.
-
The Confused Deputy in Your Agent: When the Tool Trusts the Model Too Much
Your refund tool checks whether the agent is allowed to issue refunds. Nothing checks whether the customer asking for one is entitled to it — and that gap opens without any jailbreak at all.