Separate capability from authority

An agent may be capable of editing files, executing commands, calling remote tools, and publishing results. That does not mean one request should authorize all four. Define a permission schedule for the job: read and analyze; prepare a visible patch; run bounded local checks; act on external systems. Each step changes the possible damage and the evidence a reviewer should demand. Tool interfaces describe what can be invoked, while project policy determines what should be invoked. Treat a tool's presence as availability, not consent.

Use the smallest useful grant

Give repository tasks a path boundary, a working environment, and a command budget. Separate read-only network retrieval from package installation, and separate both from writes to outside services. A connector should expose only the account and data the task requires. The MCP authorization specification defines an authorization framework for remote transports; it does not substitute for deciding whether a particular server, scope, or operation belongs in the assignment. OWASP recommends least privilege and human controls for agent-specific risks. Those are design principles to implement, not guarantees supplied by a model.

Escalate at the consequence

Approval is most useful immediately before a meaningful side effect, after the agent has made the action concrete. For example, a reviewer can examine a migration plan, a proposed message, or a release diff before the actual write. Asking at the start of an open-ended task gives the reviewer too little to judge. Conversely, approval after the call cannot prevent the side effect. Preserve the proposed target, payload, identity, and reason so the review is about an exact action rather than a broad category.

Record what authority was used

A completion note should distinguish permissions granted from tools actually used. If a command failed or a check was skipped, say so. If the agent encountered an unexpected external write, pause and re-scope. For recurring workflows, review logs for unnecessary access and reduce the default grant. This is an editorial control pattern: it will not catch every mistake, but it makes the permission boundary inspectable and the next assignment easier to narrow. A successful local patch does not imply approval to merge or deploy it. Keep the decision trace available to reviewers.

What to carry into the work

  • Inventory available tools and reachable accounts.
  • Grant the narrowest paths, scopes, and commands.
  • Place approval immediately before consequential writes.
  • Report permissions used and escalation requests.
Evidence boundary: this is a sourced editorial guide, not a hands-on product evaluation. Recommendations are our engineering analysis. Product documentation describes intended behavior, not independent proof of reliability.

Sources & dates

  1. Authorization — Model Context Protocol specification ↗Model Context Protocol · Undated source · Checked 16 Sept 2026
  2. LLM Prompt Injection Prevention Cheat Sheet ↗OWASP · Undated source · Checked 16 Sept 2026

Unknown source dates stay undated. Preparation is not publication; no historical byline or interview is implied.