Data permission is explicit
Reading a service request does not imply access to private admin notes, family history, recovery records, financial records or unrelated profile data. Permission should name exact record/field scope and purpose.
Tool permission is explicit
Drafting and sending an email are different permissions. Preparing and publishing a deployment are different permissions. Reading and deleting a document are different permissions.
Least privilege + expiry
Access should be limited to the minimum scope, time and purpose required. Temporary workflow access must not silently become permanent memory or standing administrative access.
Permission before automation
Events may trigger governed workflows, not uncontrolled autonomy. A reminder, stale-evidence flag or prepared message still follows approval and verification according to its real effect.
Secret boundary
Tool access never implies permission to expose or copy credentials. Provider tokens, service-role secrets and administrative credentials require separate technical controls and should not appear in normal content or audit output.
Reflection
Questions to sit with
- Which exact record or field does this agent need?
- Which exact tool verb is needed?
- When should this permission expire?