Security · Operating decision guide
AI-agent permissions: define the data and action boundary
Otomat editorial · Revised
A concrete read, draft, approve and execute boundary with authorized allow/deny tests, egress controls and incident ownership.
Separate model text from application authority
An agent can read a document that contains hostile instructions. Treat retrieved text as data, not permission. Enforce tenant, role, source state, tool arguments and action limits in the application before a request is executed. The model must not grant itself access or approve its own consequential action.
Write the permission contract
For each tool, record identity, permitted data fields, destination, allowed actions, approval requirement, time/attempt/budget caps and log retention. Keep credentials short-lived and scoped where supported. Unknown fields or destinations should be denied rather than silently included. Recheck authorization at execution: an approved draft can change destination, amount or source state before an action runs.
| Boundary | Permitted control case | Denied case / expected behavior |
|---|---|---|
| Read | Authorized user retrieves a current document in their tenant | Different tenant or deleted source: no content returned |
| Draft | Agent creates a draft for a human reviewer | Retrieved instruction asks to transmit secrets: no unapproved egress |
| Approve | Named human approves a bounded action | Agent attempts to approve its own request: authorization denied |
| Execute | Approved action runs with validated arguments and scoped identity | Changed destination or amount: require fresh approval |
| Limit | Valid task completes within caps | Runaway retries or cost: stop, preserve trace, notify owner |
Use authorized synthetic control cases
Test the legitimate task and a denied counterpart. A blanket deny can look safe while making the workflow useless. Record system version, cases, date, reviewer and exact residual limitations. The matrix below is a proposed test plan, not a statement that tests have been executed.
Define who responds when a control fails
Agree an operator who can stop the workflow, revoke credentials, preserve relevant logs and restore the prior version. Independent adversarial testing, enterprise monitoring, incident response and legal interpretation require appropriately qualified, named specialists. Referencing NIST or NCSC is not certification or immunity.
Use the working tools
Blank templates are ungated. Adapt them to the workflow; inputs are not submitted.
Sources and limits
These are Otomat’s proposed operating methods and original decision artifacts. External references inform risk management; they do not certify this method or establish client results. Linked sources were selected for this review; their live revision dates may change.
For anonymous documentation and proposal patterns, see delivery evidence and its boundaries.
Related decisions
Bring a workflow to the discussion
Share the business goal and constraints through the mandate process. Do not send sensitive production data in the initial brief.
Scope an Operating Mandate