Permissions for AI agents
Agent permissions describe which operations a system may attempt on which resources. They should be explicit, narrow and enforceable by the component that controls access—not merely suggested to a language model.
Make permissions specific
A permission can be narrowed along several dimensions: read versus write, resource type, named counterparty, transaction range, location, time window or purpose. Use only dimensions the underlying system can reliably evaluate. A label in a settings panel is not proof of enforcement.
- Default to deny when scope is unclear.
- Avoid broad, reusable credentials where a narrower grant is possible.
- Record the policy version and subject for each decision.
- Test both permitted and forbidden actions.
Revocation and change
Permission lifecycle matters as much as initial setup. Define how changes take effect, what happens to work already in progress and whether a cached token or queued request can outlive the grant.
A pause should stop new actions promptly; revocation should have a documented effect on pending operations. The exact timing depends on the systems involved and must be tested, not promised by wording alone.
Review before relying on a control
Ask for an implementation boundary, test evidence, failure handling and an operator-visible event record. See agent authorization for the grant and security for broader review questions.