permission system
In plain wordsThe rules that decide what an AI agent may do on its own, what it must ask a person about first, and what it may never do — like a phone's settings for which apps can use the camera.
The component of an agent harnessharness, n.: The software around an AI model that gives it instructions and tools, carries out its actions and decides when it stops. The model is the engine; the harness is the rest of the car. that decides, for each proposed tool calltool call, n.: A single request from an AI model to use one of its tools — naming the tool and filling in the details — which the surrounding software then carries out and reports back on., whether to allow it automatically, ask a human for approval, or deny it. Decisions draw on rules (allow, ask and deny lists matched against tool names, commands, file paths or web domains, with deny usually taking precedence), modes that set a session's defaults (read-only planning, auto-accepting file edits, prompting for everything, or bypassing prompts entirely), policies imposed by an organization's administrators, and sometimes a classifier model that reviews actions in place of a human. Permission systems are enforced by the harness, not the model: instructions in a prompt shape what the agent tries, but only the permission layer constrains what runs. Their central tension is approval fatigue — with too many prompts, users approve reflexively or switch checks off — so they are paired with sandboxessandbox, n.: A sealed-off computer space where an AI agent can run programs and change files without being able to harm the real system, reach private data or contact the outside world unless allowed., hookshook, n.: A user-supplied script or check that runs automatically at set moments in an AI agent's work — before a command, after a file edit, when it tries to stop — enforcing rules the AI cannot skip. and narrowly scoped credentials.
Our permission system lets the agent run tests freely, asks before any git push and blocks reading the .env file.
Origin
Adapts access-control principles — least privilege (Jerome Saltzer and Michael Schroeder, 1975) and the runtime permission prompts of mobile operating systems — to AI agentsAI agent, n.: An AI system that does not just answer but acts: given a goal, it decides on steps, uses tools such as a browser or code editor, checks the results and keeps going until the job is done.. Coding agents in 2024–2025 introduced per-tool allow and deny rules and named permission modes, and 'excessive agency' entered security checklists as the failure such systems guard against.
Usage note
Different from human oversighthuman oversight, n.: Keeping people able to watch, understand, question and, if necessary, stop or overrule an AI system, rather than letting it act unchecked. in the regulatory sense, which concerns supervision of high-risk AI systems generally. A setting that skips all checks is colloquially called YOLO modeYOLO mode, n.: Slang for letting an AI coding agent run any command without asking you first — fast and convenient, but risky, since nothing stops a harmful action..
Related
- sandboxsandbox, n.: A sealed-off computer space where an AI agent can run programs and change files without being able to harm the real system, reach private data or contact the outside world unless allowed.
- hookhook, n.: A user-supplied script or check that runs automatically at set moments in an AI agent's work — before a command, after a file edit, when it tries to stop — enforcing rules the AI cannot skip.
- YOLO modeYOLO mode, n.: Slang for letting an AI coding agent run any command without asking you first — fast and convenient, but risky, since nothing stops a harmful action.
- excessive agencyexcessive agency, n.: Giving an AI system more power than its job needs — too many tools, too-broad permissions or too little human sign-off — so that a mistake or a trick can do real damage.
- human-in-the-loophuman-in-the-loop, adj.: Describes AI systems in which a person checks, corrects or approves the machine's work at key points, rather than letting it act entirely on its own.
- levels of autonomylevels of autonomy, n.: Ladders that grade how independently an AI system acts — from a tool a person fully controls, through suggesting and asking for approval, up to acting on its own while people merely watch.
- agent identityagent identity, n.: The ways of proving which AI agent is acting, for whom and with what permissions — so websites, companies and other agents can tell trustworthy agents from impostors and hold someone responsible.
- sandboxsandbox, n.: A sealed-off computer space where an AI agent can run programs and change files without being able to harm the real system, reach private data or contact the outside world unless allowed.
Sources
- Anthropic. Configure permissions. Claude Code documentation. code.claude.com/docs/en/permissions
- Saltzer, J. H. & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9).
Mentioned in
agent instruction fileagent instruction file, n.: A plain-text file kept in a software project that tells AI coding agents how the project works — how to build and test it, which conventions to follow, what to avoid — read at the start of every session., agentic codingagentic coding, n.: Writing software by directing AI agents that plan, edit and test code themselves, with the human acting more as a reviewer and manager than as the person typing every line., background agentbackground agent, n.: An AI agent you hand a task to and then leave alone: it works by itself in the cloud, often for many minutes or hours, and reports back with finished work for you to review., Claude CodeClaude Code, prop. n.: A coding assistant from Anthropic that works as an agent: given a programming task, it explores the project, changes the code and runs programs to check its work, from the web, a desktop app, an editor or a terminal., human-in-the-loophuman-in-the-loop, adj.: Describes AI systems in which a person checks, corrects or approves the machine's work at key points, rather than letting it act entirely on its own., levels of autonomylevels of autonomy, n.: Ladders that grade how independently an AI system acts — from a tool a person fully controls, through suggesting and asking for approval, up to acting on its own while people merely watch., MCP serverMCP server, n.: A small program that makes some service — say a database, a calendar or a company's internal tools — available to any AI assistant that speaks the Model Context Protocol., sandboxsandbox, n.: A sealed-off computer space where an AI agent can run programs and change files without being able to harm the real system, reach private data or contact the outside world unless allowed., subagentsubagent, n.: A helper AI agent that a main agent starts to handle one piece of a job; it works in its own separate workspace and reports back a short summary when it is done., tool calltool call, n.: A single request from an AI model to use one of its tools — naming the tool and filling in the details — which the surrounding software then carries out and reports back on., agent identityagent identity, n.: The ways of proving which AI agent is acting, for whom and with what permissions — so websites, companies and other agents can tell trustworthy agents from impostors and hold someone responsible., confused deputyconfused deputy, n.: A security flaw in which a trusted program does an outsider's bidding with its own access rights, because it cannot tell whose request it is serving; AI agents are prone to it., excessive agencyexcessive agency, n.: Giving an AI system more power than its job needs — too many tools, too-broad permissions or too little human sign-off — so that a mistake or a trick can do real damage., hookhook, n.: A user-supplied script or check that runs automatically at set moments in an AI agent's work — before a command, after a file edit, when it tries to stop — enforcing rules the AI cannot skip., YOLO modeYOLO mode, n.: Slang for letting an AI coding agent run any command without asking you first — fast and convenient, but risky, since nothing stops a harmful action.