What should an agent be allowed to do without asking?

Six times in one afternoon, a tool on this site rewrote one of my own source files, and I was watching it the whole time. (I built the tool, which doesn't help.)

Some background first. The illustrations here are generated, and there's a small local tool for redrawing one when it's wrong. It had a feature that seemed obviously good, which was to take the page's first paragraph as the new brief.

That paragraph is usually what the drawing is about. Adopting a new brief means updating the file that stores it, so the tool wrote the new text into the settings block at the top of the content file.

Each of those steps is reasonable alone. Together they meant that clicking a drawing silently overwrote a hand-written instruction in a source file.

So curated briefs were replaced with page summaries, and illustrations were redrawn from the wrong text. There was no error anywhere, because by the tool's own definition nothing had gone wrong.

Then the first audit I ran to clean it up used a rough rule of thumb, and it missed one of them.

The destructive part came bundled with the useful part

The tool was doing what it was told, and the destructive part came bundled with the useful part.

There was one button. It meant redraw this, and it also meant replace the stored instruction with whatever is on this page. Nobody chose the second thing. It came attached to the first.

I've come to think most permission problems look like this one. Nobody deliberately hands over a dramatic capability. Somebody adds a small convenience, and it has a side effect that nobody separated out.

We wouldn't give a new colleague commit access on their first morning, with no onboarding, no review and a mandate to change anything they thought was worth changing.

We hand agents exactly that all the time, and mostly we do it by not deciding anything at all.

Elsewhere, a default like that does harm

In my case it cost nobody outside my own repository. But the pattern isn't confined to illustration tools, and the general version is not harmless.

Suppose an agent has permission to edit design tokens without asking. It can change a color that was graded for contrast into one that was not.

An agent with permission to rewrite component markup can remove an aria-label it judged redundant. An agent allowed to "tidy" a stylesheet can drop a focus style it read as decorative.

None of those changes fails a test or announces itself. They arrive as part of a larger change that is mostly good, in a diff too long to read closely, and the person who discovers them is someone who can't use the result.

Accessibility regressions live in unreviewed change, and permissions decide how much change goes unreviewed.

Asking every time is not the answer

A tool that confirms everything trains people to confirm without reading. I think that's worse than not asking, because it leaves a record of consent that means nothing.

The line I'd draw is between reversible and destructive actions, whether they're big or small.

Redrawing an image is reversible, because the old file is in git and the cost is eight cents. Overwriting a hand-written brief is destructive, because the text existed nowhere else.

Those two deserve different treatment, even though they sat in the same feature.

So I didn't fix this by putting a confirmation on everything. I separated the two. The plain button redraws from the stored brief and never touches a file.

Adopting the page text is now a second button with a different label. It sits behind a dialog that names the file it's about to overwrite.

A reasonable default separates reversible from destructive

A reasonable default mostly looks like that fix, made before the afternoon and not after it. Reversible and destructive get separated in the interface, because doing it in the documentation isn't enough and one button shouldn't do both.

The dialog names the thing that will change. "This overwrites the brief in post.mdx" asks for a decision. "Are you sure?" gets a reflex.

I'd also default to read. An agent that can read everything and write narrowly is more useful than most people expect, and it fails in ways you can see.

The approval gate is allowed to be annoying. In a multi-agent setup, a person approving the plan before anything runs feels like friction. It's also the only moment when someone with context looks before money and changes start moving.

Destructive actions should be loud in the log, and ours now prints the file it rewrote. Six silent rewrites came out of a tooling choice, so I can't call them an accident.

And when something does go wrong, audit against what you meant and not against a heuristic.

My first cleanup compared each brief to its page summary and missed the one where they differed. Comparing against the list of what I had actually written found it immediately.

Permissions are a design decision. Like most design decisions, they get made by default when nobody treats them as one.

What may this do without asking is a consequential default, and the conventions for it are still soft, so whoever thinks about them first is setting them.

Look at the agent tooling you use this week and find one thing it can change without telling you. Then decide whether you meant that.