Designing agent permissions before you design the agent

When teams design an agent, the prompt usually comes first and the permissions come last. That ordering is backwards, because the prompt is a suggestion and the permission scope is the actual guarantee.

Start by writing down the smallest set of operations the agent needs to complete its outcome, and split them by risk. Read operations against non-sensitive data are cheap to grant. Write operations that move money, change entitlements, or send external communications are not.

Then decide the approval model per operation, not per agent. A support agent might resend an invoice autonomously, draft a refund for human approval, and be entirely unable to change a billing contact.

Log arguments, not just calls. Knowing that an agent called a refund tool tells you nothing useful six weeks later; knowing which order and which amount does.

Finally, test the failure path deliberately. Give the agent an ambiguous request that sits just outside policy and confirm it escalates rather than improvises. An agent that never refuses anything has not been scoped, it has been released.