Permission design is part of the product: scope, duration and recovery should be understandable before the agent acts.
Begin with the authorised task
Describe the exact outcome the user wants and the actions required to produce it. Reading a calendar to suggest meeting times differs from sending invitations or cancelling existing events. Those operations should not share an automatic permission merely because they use the same service. A narrow starting scope makes it easier to understand both the product’s usefulness and the consequences of an error.
Separate reading from changing
Give read operations and external changes distinct controls. For a hypothetical purchasing assistant, finding suitable items can happen before any authority to place an order exists. When an action creates a commitment, show the material details at the point of decision. The interface should make it clear which steps are proposals and which have already changed something outside the conversation.
A bounded agent action
Scope
Define the requested outcome.
Authority
Grant only necessary operations.
Duration
End access when the task ends.
Audit
Record, stop and investigate actions.
Limit duration and provide a stop
Access should remain available only for the period and purpose needed. Record actions with enough detail to investigate a failure, while avoiding unnecessary exposure of sensitive data in logs. Provide a reliable way to stop further work. A visible cancel button is not sufficient if background actions continue after the user believes the task has ended.
Test the boundaries deliberately
Evaluate cases where the agent receives conflicting instructions, encounters material outside its scope or needs a permission it does not have. The correct behaviour may be to stop with a precise explanation. Measure that behaviour as part of product quality. An agent that consistently respects its operating boundary can be easier to adopt than a more ambitious system whose authority is difficult to understand.
Sources
- OWASP GenAI Security Project — source and reference material ↗ OWASP GenAI Security Project · Primary source
Have additional information? Request a correction.
