The interesting question about agent permissions is not "how do we restrict it" but "where is the line, and does it move".
Mine has moved. Here is where it sits after a month of running this on real work.
Tier 1: no approval, does not survive a mistake
Read anything, run linters and type checks, start a local dev server on a port the project already uses, open files, query a read-only replica.
The test for this tier is not "is it safe", it is "if the agent does it wrong, does anything need undoing?" Reversible and cheap to verify goes here.
Tier 2: no approval, but the diff is shown afterwards
Edit files in the repo, run the test suite, restart a local service, write rows to a scratch database, generate a report.
Everything in this tier must be reviewed before it reaches anything shared. The rule that makes it work is: the agent never pushes. It commits locally, shows me the diff, and I decide. I have not once regretted that division.
Tier 3: approval on the payload, not the intent
Sending an email, posting publicly, deleting anything outside a known temp directory, changing DNS, spending money, touching a production database.
The approval request has to contain the actual payload: full email body, the exact post text, the exact command with its arguments. "I'd like to send an email" is not an approvable request - approving it means approving whatever the agent decided the words should be.
Tier 4: not automated, by choice
Credential rotation, anything that changes access for other people, payments above a small fixed limit, and irreversible deletions.
Not because the agent cannot, but because the review cost exceeds the work. The honest name for this tier is "the agent is not the bottleneck here, I am", and pretending otherwise just adds risk.
The line that moved
One thing changed it: logs. After a few hundred actions I could see the failure distribution. Almost all of it was in reading state wrong, not in writing. So I loosened reads a lot and kept writes where they were. Before the logs I had no basis to loosen anything - I was guessing in the safe direction, which is fine, but it is not the same as knowing.
If you run this, where did your line move, and what evidence moved it?
Top comments (0)