Notes
🔍

Permission Scoping (Agent)

The question is not whether you trust the agent. It is what the agent could do on its worst run — and the answer is whatever credentials you handed it. Permission scoping is the practice of keeping that set as small as the task allows.

What gets scoped
Scoping happens in layers, and every one of them is enforced outside the model:

  • Which tools exist: an agent never given a delete tool cannot be talked into deleting.
  • What each tool may reach: a read-only database role, a token limited to one repository, file access confined to a single directory.
  • Bounds inside a tool: a refund tool capped at a value, a shell tool with an allowlist of commands.
  • Which steps need a human: irreversible actions routed through an approval gate rather than refused outright.

Why it matters
An agent reads untrusted text all day — web pages, tickets, tool output — and a prompt injection hidden in any of it can propose actions. Wording in the system prompt is not a boundary, because the model can be argued past it; refusal has to live in the credential and the runtime. Scoping is what turns a successful injection from a breach into a failed call that the agent then reports.

Doing it well
Start from the task rather than from convenience: a code-review agent needs to read the repository and post comments, not push to the main branch. Scope per environment, so a loop that is harmless in staging cannot reach production, and keep the grant readable next to the audit trail. Over-broad permissions are the usual post-incident finding, because every grant that proved too narrow got widened and never narrowed back.

Permission scoping restricts what an agent can actually do to the minimum its task requires: which tools it holds at all, what each credential may reach, value and command limits inside a tool, and which actions must pass a human approval gate. Because a model can be argued past instructions in its prompt, enforcement has to sit in the credential and the runtime. Scoping is what turns a successful prompt injection into a denied call rather than a breach.

You might give a house-sitter a key to the front door, but not your bank card. They can do the job; they cannot do much damage.

Permission scoping is that idea applied to AI software that acts on its own. Before it starts, you decide exactly what it may touch — read these files but not change them, spend no more than this much, check with me before sending anything to a customer. This matters because such software reads text from the outside world, and that text can try to talk it into doing something harmful. Limits set outside the AI still hold even when the AI itself is fooled.