Bounding what an agent can reach

The question to answer first

Not “how capable is this agent” but: if this thing does the most damaging plausible action available to it, what is destroyed and can I undo it? Answer that before you connect anything, because the answer is decided entirely by the permissions you grant, not by the model's intentions.

Three tiers, and where to start

Read-only. It can see things and produce text. The worst case is a wrong answer, which you catch by reading. Nearly all useful agent work lives here, and most people skip past it too quickly.

Write with review. It can produce a change, but the change does not take effect until a person approves it. Drafts an email; does not send it. Proposes a set of file moves; does not move them. This tier is where an agent earns real money, and the review is what makes it safe.

Write directly. It acts, and the action is live. Reserve this for narrow, reversible, well-tested actions with a defined blast radius. “File this photo into this folder” is a reasonable candidate. “Manage my inbox” is not, because you cannot enumerate what it might do.

Rules I hold to

Grant the narrowest thing that works. One folder, not the whole drive. One mailbox, not the account. A read-only key where you can. If a tool offers a scoped credential, use it — that scope is your actual safety boundary, and it is enforced whether or not the model cooperates.

No irreversible actions. Deleting, sending to outsiders, spending money, changing permissions. If an agent must do one of these, it goes behind a human approval every single time, with no “always allow” option. I have an approval queue for exactly this, and the friction is the feature.

Bound the volume, not just the kind. “May move files” and “may move four thousand files” are different permissions. Put a ceiling on how much it can do in one run and stop above it. An agent in a loop is not a rare event.

Separate identity. Give the agent its own account, not yours. You get a clean audit trail, you can revoke it in one action without disrupting yourself, and you find out what it actually touched.

Test the bound, not the intention

Do not rely on having told it what not to do. That instruction is a preference; the permission is the boundary. Verify by attempting: ask it to read a file it should not be able to reach, and confirm it cannot, rather than that it politely declines. An agent that declines is being agreeable. An agent that gets a permission error is bounded.