- 01An agent is a new identity class — 'X acting on behalf of Y' — and a new failure class: doing something the user would never authorize because something the agent read along the way said so.
- 02Five non-negotiable design principles: least authority by default, time-bound delegation, explicit confirmation for irreversible actions, per-tool human-readable summaries before execution, replayable audit of every decision.
- 03Hand the agent capability tokens (macaroons or short-lived OAuth scopes), never long-lived API keys with broad scope. Constraint via prompt is theatre.
- 04Reversibility is a security property: drafts before sends, soft-deletes with windows, dry-runs that produce diffs. Constrained authority + reversibility makes most agentic incidents recoverable.
Agentic systems introduce a new identity class — the agent acting on behalf of a user — and a new failure class: the agent doing something the user would never authorize, because something it read along the way told it to.
Design principles for agent permissions
- 01Least authority by default — agents start with read-only scopes
- 02Time-bound delegation — capability tokens expire fast
- 03Explicit confirmation for any irreversible action
- 04Per-tool human-readable summaries before execution
- 05Replayable, auditable trace of every agent decision
Capability tokens, not API keys
Hand the agent a token that can do exactly the operations it was authorized for, scoped to specific resources, with a short lifetime. Macaroons or short-lived OAuth scopes work well. Avoid handing the agent a long-lived API key with broad scope, then trying to constrain it through prompts.
Reversibility as a security property
Whenever feasible, design the systems an agent acts on to support reversal: drafts instead of sends, soft-deletes with a window, dry-runs that produce a diff. The combination of constrained authority and reversibility makes most agentic incidents recoverable, not disastrous.