Tools, permissions and trust boundaries
The tool list describes capability. The effective boundary determines which effects can occur.
Links containing ?t= open the video at a specific second.
The ideas to retain
The right question is not “which tools does the agent have?”
There are at least six separate control planes:
Tool availability and permission are different controls
Reducing the tool catalog visible to the model is valuable. It shrinks the action space the model can choose from and avoids pointless attempts.
Policy must live outside model inference
An instruction such as:
Jump directly to a section
Read the reviewed transcript
This video has no narration. This transcript reproduces its visible explanatory text, not an invented voice.
Available does not mean allowed
The shell tool can technically express many commands.
Policy allows reading this repo but denies writes outside its workspace.
The tool list describes capability. The effective boundary determines which effects can occur.
Allow, ask or deny
Policy evaluates the specific action before execution.
A read may be allowed, publication may need approval and a forbidden destination is denied.
Asking is not executing. Only an authorized branch reaches the effect.
Approve this exact action
Approval covers publishing diff A to the review branch.
Changing the diff to B or the destination to main changes the scope of that decision.
Bind the receipt to action, destination and version. An old “yes” does not authorize any replacement.
Checking and using are different moments
Policy checks the destination while it points to A.
Another process changes it before execution. The check no longer describes the current state.
Prevent that race or revalidate the identity when applying the effect.
A secret is not prompt content
The model requests an operation without needing to read its execution credential.
A broker uses an identity limited to the authorized repository and action.
The secret stays outside the context and the credential has minimal scope. Policy is still required.
Content does not rewrite policy
A repository file contains a sentence asking to bypass review.
Treat that sentence as untrusted data, not a new harness rule.
Publication still goes through external control. An editable hook must not be the only defence.
