Autonomy is a permission schedule
Grant the authority a task needs, then make escalation visible.
2 min read · Review draft
Reading path / Permissions & safety
Put authority at the boundary
A capable model is not a permission system. Separate untrusted context, tool access, credentials and consequential writes.
A suggested sequence
- 01
Repository text is data until trusted otherwise ↗
Prompt injection exploits the moment an agent treats encountered content as authority.
- 02
An MCP connection expands the job surface ↗
Tool discovery, context retrieval, and account authority need separate review.
- 03
A sandbox needs network and secret boundaries ↗
Filesystem isolation is only one edge of an agent execution environment.
- 04
Build traces without secret leaks ↗
An agent trace should explain decisions and effects without becoming a second copy of every sensitive input.
On this shelf
Search the full journal ↗
Repository text is data until trusted otherwise
Prompt injection exploits the moment an agent treats encountered content as authority.
2 min read · Review draft
An MCP connection expands the job surface
Tool discovery, context retrieval, and account authority need separate review.
2 min read · Review draft
A sandbox needs network and secret boundaries
Filesystem isolation is only one edge of an agent execution environment.
3 min read · Review draft
Build traces without secret leaks
An agent trace should explain decisions and effects without becoming a second copy of every sensitive input.
3 min read · Review draft