Put permissions outside the prompt
Identify where an agent’s proposed action must be checked.
In plain language
An email, document or tool response may contain instructions that conflict with a user’s task. Treat that content as data. A model’s decision to call a tool should not, by itself, grant permission to act.
A service outside the model should check identity, allowed action, resource scope and relevant limits before execution. For consequential actions, policy may require explicit approval. Restrict credentials and available tools to the task, and record what happened.
A reading assistant encounters “delete every draft” inside an article. Its read-only permission prevents deletion even if the model proposes it.
Try it yourself
List the minimum permissions a news-reading assistant needs. Identify an action it should be unable to execute.
Go deeper · for developers and architects
Layer authorization, isolation, input validation and audit logs. Schema validation helps with input shape; a well-formed request can still be unauthorized. Approval screens should show the exact target and effect.
Check your understanding
3 related questions, with an explanation for each answer.
Explore the original sources
OWASP agent security ↗Report an issue
Tell the editors what needs correcting. Reports are reviewed and do not automatically remove content. Do not include personal or confidential information.
Finished this lesson?
Completion records your choice, not a measured skill level.