Part 2 · The Harness Around the Model

Permissions & Security

5 permission modes + LLM risk levels + Human-in-the-loop design

THE QUESTION THIS PAGE ANSWERS

ANSWER FIRST

What is the key idea behind “Permissions & Security”?

5 permission modes + LLM risk levels + Human-in-the-loop design

DECISION RULE

Make the claim earn its place. Use this page as a decision aid, not a definition to memorize. Connect the idea to one real task, one observable result, and one failure that would change your mind.

TRY NEXT

Write one question you could answer with evidence after trying this idea.

WATCH FOR

A conclusion that sounds complete but leaves the key assumption untested.

Choose Permission Mode
Confirm Mode Default
Every dangerous action requires user confirmation
Auto Mode Dangerous
All actions are executed automatically with no confirmation
Smart Mode the example system
An LLM classifier assesses risk level and handles each action accordingly
Scenario Simulation
Scenario: Agent wants to execute 5 actions
Observe how each action is handled in the current mode
# Action Tool Metadata Risk Assessment Result
Select a permission mode → click Run → observe the difference
Three Design Decisions
📌 Design Decision 1: The core tension in permission design is safety vs. efficiency. Every confirmation dialog interrupts the user flow, but skipping confirmations risks irreversible damage. Which does your product choose?
📌 Design Decision 2: the example system's "Smart Mode" uses an LLM to assess risk, but LLM judgments can be wrong. A single misclassification could delete user data. Is this a risk you can accept?
📌 Design Decision 3: "Read-only" and "destructive" are tool-level flags. It's the PM's job to decide which risk tier each tool belongs to — this is a product decision, not something you can hand off to engineering.
Takeaway
Takeaway The essence of Agent permission design is finding the right balance between safety and efficiency: confirming everything is safest but slowest; allowing everything is fastest but most dangerous. the example system's approach is to use AI to assess risk level — low-risk actions are auto-approved; high-risk actions are intercepted for confirmation.
⚠️
Agent Requesting Permission
Deny
Allow

Where the risk boundary sits in “Choose Permission Mode”

“5 permission modes + LLM risk levels + Human-in-the-loop design” moves security beyond telling a model not to make mistakes. The real protection is ensuring that a mistaken judgment cannot become an irreversible result through permissions, data, or the environment.

Separate model suggestions from real authority

In the flow described by “5 permission modes + LLM risk levels + Human-in-the-loop design”, check what the user may request, what the model may suggest, what the tool actually permits, and who can approve a write or send action. Web pages, documents, and tool results can carry untrusted instructions; looking like documentation does not grant them authority.

Security includes failure and recovery

Use “5 permission modes + LLM risk levels + Human-in-the-loop design” for a reverse exercise: add bad input, a missing credential, or an approval that never arrives. Confirm that the system refuses, pauses, and leaves a trace instead of executing to completion.

From “Choose Permission Mode” to “Scenario Simulation”

“Choose Permission Mode” grounds the problem in “Confirm Mode Default Every dangerous action requires user confirmation Auto Mode Dangerous All actions are executed automatically with no confirmation Smart Mode the example system An LLM classifier assesses ri…”. “Scenario Simulation” then moves it toward “Scenario: Agent wants to execute 5 actions Observe how each action is handled in the current mode ▶ Run Simulation Reset # Action Tool Metadata Risk Assessment Result Select a permission mode → click Run → obse…”. Together, they show that the lesson is not just a conclusion to remember, but a claim with conditions.

Carry the judgment into the next situation

For security, separate what the model wants to do from what the system permits. Check data boundaries, tool permissions, human confirmation, and recovery after failure.

  • “Choose Permission Mode”: Confirm Mode Default Every dangerous action requires user confirmation Auto Mode Dangerous All actions are executed automatically with no confirmation Smart Mode the example system An LLM classifier assesses ri…
  • “Scenario Simulation”: Scenario: Agent wants to execute 5 actions Observe how each action is handled in the current mode ▶ Run Simulation Reset # Action Tool Metadata Risk Assessment Result Select a permission mode → click Run → obse…
  • “Three Design Decisions”: 📌 Design Decision 1: The core tension in permission design is safety vs. efficiency. Every confirmation dialog interrupts the user flow, but skipping confirmations risks irreversible damage. Which does your pr…

The final “Three Design Decisions” brings the discussion to “📌 Design Decision 1: The core tension in permission design is safety vs. efficiency. Every confirmation dialog interrupts the user flow, but skipping confirmations risks irreversible damage. Which does your pr…”. The useful thing to carry forward is knowing which judgments must be revisited when input, scale, or risk changes.

Mark as learned Your reading progress updates automatically
← PreviousNext →

Keep reading

The next useful article in the thread.

ARTICLE DISCUSSION

Leave one useful thought here.

Keep the idea that clicked, the question that stayed open, or a small note for the next learner.

Discussing Permissions & Security The Harness Around the Model
3discussionsArticle discussion · synced with the Circle
View in the learning circle
AM
Asha MorganContent editor
INSIGHTField note

I turned one judgment from this article into a small experiment I could run today. Knowing what to observe next is more useful than simply remembering the conclusion.

ARTICLE DISCUSSION7 helpful
LH
Lin HarperIndie developer
INSIGHTInsight

After reading this, I first looked for the conditions behind the idea instead of copying the method into a project. That order made the later trade-offs much clearer.

ARTICLE DISCUSSION5 helpful
KM
Kiki MooreProduct operations
QUESTIONQuestion

When this judgment reaches real work, which constraint should be added first? I am curious which step matters most between reading and the first practical attempt.

ARTICLE DISCUSSION4 helpful