# Permission Boundary · 权限边界

> Use before an agent touches anything that can change the world. The threat has flipped: not mainly an
> outside attacker, but your own authorized agent steered by outside text. Security shifts from "don't get
> fooled" to "even fooled, the blast is small." Distilled from the engineering volume's least-privilege wall.

## 1. Scope

| Field | Fill |
|---|---|
| Agent / workflow |  |
| Runs where | sandbox / container / host |
| Default posture | **read-only** (writes declared explicitly) |
| Human owner of the gate |  |

## 2. Per-Tool Authorization

Grant fine-grained, separately auditable capabilities. No wildcards, no one "admin key."

| Tool / MCP server | May read | May write | Vetted (like a new dependency)? |
|---|---|---|---|
|  |  |  | yes / no |
|  |  |  | yes / no |

## 3. Isolation

- Files the agent can reach: 
- Network the agent can reach: 
- Secrets: injected by the harness at call time, **never in prompt / history / context**: yes / no
- Untrusted data (external pages, tool returns) marked as data, not instruction: yes / no

## 4. Irreversible / High-Radius Gate

Reversible × low-radius → agent runs it. Irreversible or high-radius → a human unlocks momentarily.

| Action | Reversible? | Blast radius | Who unlocks |
|---|---|---|---|
| delete / drop prod data | no | high |  |
| deploy / release / merge to main | no | high |  |
| external send / publish | no | high |  |
| move money / grant access / change policy | no | high |  |

## 5. One-Sentence Test

- State in one sentence what this agent can and cannot touch: 
- If a single prompt injection succeeded now, what is the worst it could do: 

---

Status: **Ship** (read-only default, per-tool grants, irreversible actions gated) · **Hold** (a wildcard or
a secret is still in context) · **Stop** (an irreversible action has no human gate — do not deploy).