Technical guide
Understanding AI Agent Permissions
How tool, OAuth, browser, filesystem and execution permissions change an agent’s risk profile.
Start with deny-by-default
Agent permissions should be explicit and narrow. Avoid wildcard access, separate read from write identities, restrict network destinations and require human approval for consequential actions.
Tool permission is not the same as authorization
A model being allowed to request a tool call should not automatically authorize the external side effect. Runtime code should independently validate identity, resource scope, policy and approval state.