An agent without permissions is a text generator. An agent with unlimited permissions is a security risk. The challenge is defining the right permission boundaries: enough access to be useful, restricted enough to be safe. This is not a new problem — it is the same principle as user access control (RBAC), applied to AI agents.
The Permission Model
Agents should follow the same RBAC (Role-Based Access Control) model as users: each agent has a role, each role has specific permissions, and each permission defines what actions the agent can take. Example: a 'support agent' role can read customer data, draft responses, and escalate tickets — but cannot delete customers, modify billing, or access admin functions. The permission model should be: explicit (the agent can only do what is listed), default-deny (anything not explicitly permitted is forbidden), and auditable (every permission check is logged).
Per-Tool Permissions
Each tool should declare its required permission level. The agent runtime checks whether the agent's role includes that permission before executing the tool. This prevents: the agent calling tools it should not have access to, the agent exceeding rate limits for specific tools, and the agent executing high-risk actions without explicit permission. The permission check should happen before the tool is called, not after.
Warning
Never rely on the LLM to self-enforce permissions. The LLM can be manipulated. Permission enforcement must happen at the infrastructure layer, not the model layer.
Confirmation Gates
Some actions are too risky to automate, even with permissions. Implement confirmation gates: actions above a risk threshold require human approval before execution. The gate should: pause the agent's execution, present the proposed action and its consequences to a human, wait for explicit approval or rejection, and log the decision. Confirmation gates are not a failure of automation — they are a feature of safety. The UX should make confirmation fast (one click) and informative (clear description of what will happen).
Conclusion
Agent permissions are the same principle as user access control, applied to AI. Explicit permissions, default-deny, per-tool access checks, and confirmation gates for high-risk actions. The permission model should be enforceable at the infrastructure layer, not the model layer.
Key Takeaways
- Agents should follow RBAC: each agent has a role, each role has specific permissions
- Explicit permissions, default-deny, auditable — same principles as user access control
- Permission enforcement must happen at the infrastructure layer, not the model layer
- Confirmation gates for high-risk actions are a safety feature, not a failure of automation
- Each tool declares required permissions; the runtime checks before execution