Execution Permissions and Approval
Permissions granted to tools are the central safety design for an AI agent. The baseline is not prohibiting an action by instruction but making it impossible in the first place.
Least Privilege
Grant only the minimum the work requires. Handing over broad permissions because they “might be needed later” widens the blast radius of any mistaken judgment.
| Decision | Content |
|---|---|
| Scope | Limit which directories, tables, or endpoints can be touched |
| Operation type | Read only, or writes as well |
| Execution condition | Always allowed, or approval required |
Separate Reads From Writes
Putting reads and writes in one tool makes the permission unit coarse. Splitting them allows reads to run automatically while writes stay approval-gated.
# Not separated
manage_file(path, mode, content) # reads and deletes through one entry point
# Separated
read_file(path) # safe to run automatically
write_file(path, content) # runs after presenting the diff
delete_file(path) # approval requiredEnforce Through Mechanism, Not Instruction
Writing “do not modify production” in the prompt helps, but it is not sufficient on its own. Instructions are interpreted, and they thin out over long work.
Implementing the constraint in the tool is far more reliable.
- Restrict a write tool’s target directory through configuration
- Never hand production connection details to the agent at all
- Require an explicit target condition as a mandatory parameter on delete tools
Placing Approval
Approval follows the same criteria as designing autonomy levels: place it immediately before an irreversible operation, showing concretely what will run.
Hooks are the mechanism that inserts this check automatically, running a validation just before tool execution and blocking it when conditions are not met.
Summary
- Design tool permissions around least privilege
- Splitting reads and writes into separate tools makes permission granularity finer
- Do not rely on prompt prohibitions alone; enforce constraints in the tool implementation
- Ask for approval immediately before irreversible operations, with concrete detail