auditing-ai-agent-permissionslisted

# Auditing AI agent permissions: agency is what's left when the prompt defense fails Prompt-level defenses are probabilistic and bypassable. What remains after an injection succeeds is what the agent is permitted to do, so the durable control is the permission set, not the model's judgment. Auditing agency means comparing every capability the agent holds against what its task actually requires, and gating the actions that cannot be undone. ## When to use - You are granting an agent a new tool, scope, credential, or autonomous action. - You are reviewing an agent's permission and egress posture. - You are deciding which actions require human approval and which can run freely. - You are scoping a code interpreter or shell an agent can drive. ## Scope check Audit agents and systems you own or are authorized to test. Do not exercise destructive or irreversible actions against systems you do not control. If you can't name the authorization, stop. ## The loop 1. **Diff granted capability against required capability.** List every tool, scope, credential, and autonomous action the agent has. Beside each, write what the task actually needs. The gap is excessive agency: a summarizer with delete rights, a read task holding a write token, a support bot that can issue uncapped refunds. 2. **Classify actions by reversibility and blast radius.** Mark each action reversible or irreversible, low or high impact. Irreversible or high-impact actions (deleting data, send