Requirements
- One list states the operations the agent may perform, the values each may carry, and the destinations each may reach.
- The list is written before the agent runs, and a person reviews it.
- Anything the list does not name is refused.
- The tools an outside service offers are admitted one at a time, and only by name.
- Whatever holds the model cannot carry out an action. It can only ask for one.
- Whatever carries out the action checks the request against that same list again, before it runs.
- A reader learns what the agent can do from the list, and does not infer it from how the model behaves.
Security considerations
Assume the model is fully under attacker control, and emits any call the attacker chooses. The call is still checked against a list the attacker cannot edit. The worst outcome is therefore a refused request. Instructions to the model, and filters on what the model reads, change how often a bad request arrives. They do not change what happens to that request, so neither is a control for this primitive.
Residual risk: The list is the control, so an entry written too broadly is granted exactly as written.
Non-qualifying systems
Commonly substituted components: a sandbox, or a wrapper that forwards whatever the model emits. Any of the following disqualifies a system:
- The tool's name describes what the agent may do. Nothing enumerates the permitted calls.
- A subcommand or an option nobody reviewed is available the moment the underlying tool supports it.
- The component that decides whether a call is permitted is the component that asked to make it.
- The only limit on a call is where it runs and how far its effects reach. Nothing limits which operation runs, or with which arguments.