Volume IX
The Agent-Computer Interface
Permissions, injection, identity, the visible loop
The ACI is the real prompt: tool names, schemas, errors, and the permission gate in front of every side effect. Security is an allowlist, not a system prompt. The human must be able to see the loop as it runs.
- IX.1Allow, Ask, DenyEvery side-effecting tool sits behind a permission. Allow what is cheap and reversible. Ask what is consequential. Deny what is out of scope. The model proposes; the gate decides.7 min
- IX.2Injection, Poisoning, Confused DeputyAnything the model reads — web pages, PDFs, MCP tool descriptions, retrieved docs, other agents' briefs — is an untrusted speaker. Treat it as data, never as an instruction channel.8 min
- IX.3Designing the Agent-Computer InterfaceThe ACI is names, schemas, errors, pagination, and idempotency. A sloppy tool surface makes a smart model look drunk. A tight one makes a small model look hired.8 min
- IX.4Secrets, Identity, Least PrivilegeThe agent is a principal. It gets the credentials of the job, not the credentials of the developer. Subagents inherit a subset. Logs never print secrets. Memory never stores them.6 min
- IX.5Show the LoopIf the human cannot see the plan, the tool call, and the observation as they happen, they cannot interrupt, cannot trust, and cannot debug. Transparency of the loop is a product requirement, not a nice-to-have trace.6 min