The latest articles on DEV Community by Chanpreet Singh (@chanpre75813933). https://dev.to/chanpre75813933 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4167511%2Fe1f0b143-cbe5-4971-8618-0d0c6ddf1fac.jpg https://dev.to/chanpre75813933 en Chanpreet Singh Tue, 06 Oct 2026 23:46:45 +0000 https://dev.to/chanpre75813933/your-ai-agent-doesnt-need-fewer-permissions-it-needs-a-mission-3c6g https://dev.to/chanpre75813933/your-ai-agent-doesnt-need-fewer-permissions-it-needs-a-mission-3c6g <p>If you've been on dev Twitter or Hacker News this month, you've seen the stories. An agent asked to clean up a folder deletes tens of thousands of files. A coding agent launches hundreds of parallel runs nobody asked for and burns through a five-figure bill. Someone's OpenClaw setup emails their clients without approval. Someone else writes "never touch production" in CLAUDE.md, and the agent reads every secret in the <code>.env</code> anyway.</p> <p>None of these agents were "hacked" in the movie sense. They were doing roughly what they were built to do: take actions with real tools. The problem is that nothing between the agent and the tool asked a simple question first:</p> <p><strong>Is this action part of the job?</strong></p> <h2> Permissions aren't the same as intent </h2> <p>The usual advice is to give agents fewer permissions. That helps, but it runs into a wall fast. A coding agent needs to delete files sometimes. An inbox agent needs to send email. A deploy agent needs to touch production. Take those away and the agent is useless; leave them and any one bad step can do damage.</p> <p>What's missing is a check on <em>intent</em>, not just <em>access</em>. "Delete files in <code>/tmp/build</code>" during a cleanup task is fine. "Delete the home folder" during the same task is not. Both use the same permission.</p> <h2> What I'm building: Watchdog </h2> <p>That's the idea behind Watchdog, one of the two things I'm building under <a href="https://aloviaai.com" rel="noopener noreferrer">Alovia AI</a>. You give your agent a one-line mission, like "triage my inbox and draft replies, never send." Before each action runs, Watchdog checks it against that mission. On-mission actions go through. Off-mission ones get stopped, and you see why.</p> <p>It sits around the agent's traffic rather than inside the model, so it works with any model, open-source or frontier, and with setups like Claude Code, Codex, OpenClaw or Hermes.</p> <p>I tested it against AgentDojo-style prompt-injection attacks, where a tool result tries to hijack the agent into doing something else. In our full configuration, <strong>0 of 809 attacks got through</strong>. In a lighter policy-only mode, it stopped about half with <strong>zero false positives</strong> on legitimate tasks.</p> <h2> The other side: Shield </h2> <p>The same shift is hitting websites from the other direction. Site owners are posting about AI crawlers multiplying their Vercel bills, residential-proxy scrapers making up 99% of a small forum's traffic, and bots testing stolen cards through free trials.</p> <p>Shield sits in front of your site, alongside Cloudflare rather than replacing it, and stops abusive bots, AI scrapers and fake signups before they reach your origin, without putting a captcha in front of real people.</p> <h2> Try it </h2> <p>It's in free private beta with 20 seats, for people running agents or sites that are getting hammered. If either of these sounds like your week, grab one at <a href="https://aloviaai.com" rel="noopener noreferrer">aloviaai.com</a> or drop a comment with what broke. I read every one.</p> <p><em>Chan, building Alovia AI</em></p> ai security agents webdev