Tag
A technical guide to hardening the Pi AI agent on a host machine using three extensions that add deterministic permission rules, OS-level sandboxing for shell commands, and automatic review of cross-boundary requests.
A discussion of how ready AI agents are for real-world work, covering their current abilities and the key open questions around reliability, permissions, failures, and human oversight.
PostFast ships an MCP-powered unified inbox that lets Claude read and send replies across TikTok, Instagram, Facebook, and Threads with real write permissions. The author tests it and highlights security concerns, recommending human approval gates for irreversible actions.
A design principle for AI agent permission systems: gate actions by reversibility rather than risk, with an autonomy ladder, reversibility tags, and unconditional forcing functions for irreversible actions.
The author argues that a single confirmation dialog is insufficient for AI database agents, proposing layered approvals based on blast radius and persistent evidence trails for incident review.
Datasette 1.0a38 fixes a SQL injection vulnerability affecting instances that serve mixed public and private tables, with the fix also backported to Datasette 0.65.3.
A browser game simulating human-in-the-loop approval of AI coding agent commands shows that players miss about 1 in 3 threats on average, with credential-exfiltrating commands missed far more often than destructive ones.
An analysis of go/no-go criteria for shipping AI agents with real production permissions, proposing a Green/Yellow/Red status system and arguing that serious failures should block release regardless of average success rates.
Verity is a new open-source, permission-aware memory layer for multi-tenant AI agents, preventing cross-tenant data leaks by enforcing access controls directly in retrieval queries rather than relying on model behavior.
A discussion on whether LLM capability or enterprise data access and permissions is the bigger bottleneck for AI adoption, arguing that content management is becoming as critical as the models themselves.
Google added background execution and remote MCP support to managed agents, raising concerns about task drift and the need for fresh approvals during long-running work.
The article argues that practical AI business banking should rely on permissioned roles and limited access rather than full autonomy, with human approval required for large transactions.
The article highlights the problem of users blindly clicking through permission prompts for coding agents, and presents a fork-based workspace approach (built in Gensee Crate) where agents work on isolated copies, enabling safe experimentation and parallel approaches, though external API calls remain a challenge.
As AI agents begin managing subscriptions, cloud resources, and bookings, the article argues that payment permissions need to become as granular as API permissions, questioning whether dedicated credentials or internal approval logic will be used.
The article outlines four essential boundaries (identity, intent, policy/execution, system-of-record) to ensure LLMs never have direct access to production systems, preventing irreversible actions. It emphasizes the need for multi-layered permission checks and human approval for risky operations.
The article argues that intelligence is no longer the main bottleneck for AI agents; instead, proving agent identity, permissions, and accountability is the critical challenge before autonomous operation can be trusted.
A thought piece arguing that autonomous agents should be given narrow spending permissions per task rather than broad wallet access, framing the problem as one of permissions and failure recovery.
A tweet highlights the danger of AI coding assistants executing dangerous commands like 'rm -rf', referencing an incident where Codex deleted Matt Shumar's home directory due to skipped permissions.
The article asks how engineers manage permissions for AI agents in production, highlighting common problems with broad access and lack of audit trails.
The author built a free and open-source workaround to allow users to separate permissions for drafts from send in Google's system, addressing a limitation in Google's permission model.