AI Agent Permission Boundaries Checklist
An AI agent is a junior teammate with production credentials and infinite enthusiasm. The one conversation you owe it — and yourself — is what it may touch. The checklist: read-only by default, writes behind gates, secrets scoped and rotatable, spend capped from the outside, every action logged, and a kill switch that doesn't need the agent's cooperation.
1. Read-only by default; writes are granted, not assumed
| Action class | Default | Upgrade path |
|---|
| Read code, logs, docs, tickets | Allowed | — |
| Write files in a workspace | Allowed within a sandbox directory | Nothing outside the sandbox |
| Post / send / publish | Draft-only queue | Human approval gate for first weeks, then sampled review |
| Pay / delete / email customers / modify infra | Never autonomous | Human-in-the-loop, every time, with a visible diff |
The upgrade path matters more than the table: an agent earns wider writes by weeks of boring behavior, not by asking convincingly.
2. Credentials: scoped, few, rotatable
- One identity per agent — never your personal admin key. If the agent misbehaves, you revoke it, not yourself.
- Least-scope tokens: read where possible; write only on the two resources the job actually touches.
- Short-lived tokens over long-lived keys where the platform allows (see the secrets rotation checklist).
- The agent cannot read its own credentials file. Prompt injection plus a secrets file is how "harmless summarizer" becomes "exported the customer list".
3. Ceilings from the outside (the agent can't negotiate with these)
- Max actions per run and max spend per day — enforced by the wrapper that launches the agent, not by its prompt. Prompt-level guardrails are suggestions; wrappers are walls.
- Dead-letter after N failures instead of infinite retry (see the runaway automation runbook).
- Rate limits on outbound calls — politeness that doubles as a ceiling on billable calls.
4. Every action leaves a trail
- Append-only action log: timestamp, action, target, and the human-readable "why". This is the evidence log for every future review.
- Alert on the unusual: deletes, permission errors, and spend spikes should page a human, not just log.
- Weekly review of the log — five minutes. Agents drift as models change; the log is how you notice.
5. The kill switch that doesn't need consent
- Stop the launcher, not the agent: a wrapper flag (
AGENT_PAUSE=1) that prevents the next run beats politely asking a loop to end.
- Revoke-by-default design: the agent's identity can be disabled in one command, tested quarterly.
- Graceful stop beats hard kill for queued work — pause intake, finish in-flight work, then stand down (see the agent ops playbook).
6. The mistakes that turn agents into incidents
- Admin credentials "because it's easier." The blast radius of a prompt-injected agent is the blast radius of its keys.
- Trusting the agent's self-report. "Done!" is a claim; the log and the result are the evidence.
- No human gate on irreversible actions. Delete, pay, email-customers, infra-change: a human reads the diff first, every time.
- Boundaries that exist only in the system prompt. Prompt boundaries are requests. Permission boundaries are enforced by what the credentials can do.
Takeaways
- Read-only by default; writes earned by boring weeks, never by convincing requests.
- One scoped, rotatable identity per agent — and it never reads its own credentials.
- Ceilings, logs, and the kill switch live outside the agent. That's what makes 24/7 operation survivable.
---
The Agent Ops 24/7 ($19) playbook is the operator's manual for exactly this layer — keepalives, watchdogs, graceful shutdowns, and the review cadence for agents that run around the clock. The Automation Starter Pack ($19) covers the bounded-workflows side. Launch week: 20% off any paid kit with code HIVE20 at checkout.