Judgment in the Age of AI · Article 34
An AI agent that can read, operate tools and act on your behalf carries more risk than a chat tool that only produces text. Permission should not be granted all at once according to what the agent can do, but step by step according to the consequences of failure.
Begin at the lowest stair
| Level | Permission | Suitable control |
|---|---|---|
| 1 Observe | Read only public or low-sensitivity information | Restrict data scope |
| 2 Propose | Draft an action without executing it | Human inspection |
| 3 Reversible action | Organise files or create drafts | Logs, backup and undo |
| 4 External action | Send, publish, book or buy | Confirmation before every action |
| 5 High-impact action | Pay, delete, change access, make legal or safety decisions | Normally no autonomy; strong authentication and two-person approval |
Every permission also needs three boundaries
- Scope: Access only the data and tools required for the task;
- Value or volume: Limit both single and cumulative impact;
- Time: Make authority expire automatically when the task ends.
Malicious content in a webpage, email or file may steer an agent away from its instructions. However capable the model appears, least privilege, human confirmation and reversibility remain primary defences.
References
Discover more from Geoffrey Chen
Subscribe to get the latest posts sent to your email.