What should an agent be allowed to do without asking?

Six times in one afternoon, a tool on this site rewrote one of my own source files. I was watching it the whole time. And I built the tool, which doesn't help.

Some background first. The illustrations here are generated, and there's a small local tool for redrawing one when it's wrong. It had a feature that seemed obviously good: take the page's first paragraph as the new brief.

That paragraph is usually what the drawing is about, and adopting a new brief means updating the file that stores it. So the tool wrote the new text into the settings block at the top of the content file.

Each of those steps is reasonable on its own. Together, they meant that clicking a drawing quietly overwrote a hand-written instruction in a source file.

So carefully written briefs were replaced with page summaries, and illustrations were redrawn from the wrong text. There was no error anywhere, because by the tool's own definition, nothing had gone wrong.

Then the first audit I ran to clean it up used a rough rule of thumb, and it missed one of them.

The destructive part came bundled with the useful part

The tool was doing what it was told. The harm came attached to the help.

There was one button. It meant redraw this. It also meant replace the stored instruction with whatever is on this page. Nobody chose the second thing; it came attached to the first.

I've come to think most permission problems look like this one. Nobody deliberately hands over a dramatic power. Somebody adds a small convenience, and it has a side effect nobody separated out.

Think about it this way. We wouldn't give a new colleague commit access on their first morning, with no onboarding, no review and a mandate to change anything they thought was worth changing.

But we hand agents exactly that all the time, and mostly we do it by not deciding anything at all.

Elsewhere, a default like that does harm

In my case it cost nobody outside my own repository. But the pattern isn't confined to illustration tools, and the general version is not harmless.

Say an agent may edit design tokens without asking. It can change a color that was graded for contrast into one that wasn't.

An agent allowed to rewrite component markup can remove an aria-label it judged redundant. An agent allowed to "tidy" a stylesheet can drop a focus style it read as decorative.

None of those changes fails a test or announces itself. They arrive inside a bigger change that's mostly good, in a diff too long to read closely. And the person who finds them is someone who can't use the result.

Accessibility regressions live in unreviewed change, and permissions decide how much change goes unreviewed.

Asking every time is not the answer

So should a tool ask every time? A tool that confirms everything trains people to confirm without reading. I think that's worse than not asking, because it leaves a record of consent that means nothing.

The line I'd draw is between reversible and destructive actions, big or small.

Redrawing an image is reversible: the old file is in git, and the cost is eight cents. Overwriting a hand-written brief is destructive, because the text existed nowhere else.

Those two deserve different treatment, even though they sat in the same feature.

So I didn't fix this by putting a confirmation on everything. I separated the two. The plain button redraws from the stored brief and never touches a file.

Adopting the page text is now a second button, with a different label. It sits behind a dialog that names the file it's about to overwrite.

A reasonable default separates reversible from destructive

A reasonable default mostly looks like that fix, made before the afternoon instead of after it.

Reversible and destructive get separated in the interface. Doing it in the documentation isn't enough, and one button shouldn't do both.

The dialog names the thing that will change. "This overwrites the brief in post.mdx" asks for a decision, while "Are you sure?" gets a reflex.

I'd also default to read. An agent that can read everything and write narrowly is more useful than most people expect, and it fails in ways you can see.

The approval gate is allowed to be annoying. In a multi-agent setup, a person approving the plan before anything runs feels like friction. But it's also the only moment when someone with context looks, before money and changes start moving.

Destructive actions should be loud in the log, and ours now prints the file it rewrote. Six silent rewrites came out of a tooling choice, so I can't call them an accident.

And when something does go wrong, audit against what you meant, not against a rule of thumb.

My first cleanup compared each brief to its page summary, and it missed the one where they differed. Comparing against the list of what I had actually written found it right away.

Permissions are a design decision. And like most design decisions, they get made by default when nobody treats them as one.

What may this do without asking is a default with consequences. Its conventions are still soft, so whoever thinks about them first is setting them.

So look at the agent tooling you use this week. Find one thing it can change without telling you, and then decide whether you meant that.