PERMISSIONS AND ACCESS CONTROL

LEARNING GOALS By the end of this chapter you will be able to explain the permission resolver in depth, apply least privilege, use allow-lists and deny-lists, design human approval for high-risk actions, and handle identity and secrets safely. WHAT IS ACCESS CONTROL? Access control is the practice of deciding who or what is allowed to do which things. A hotel offers a simple picture. Your key card opens your room and the gym, but not other guests' rooms or the manager's office. Housekeeping cards open many rooms, but not the safe in the office. Each card carries exactly the access that the role requires. For agents, the equivalent decisions are about which tools, files, systems, and actions an agent may use. THE PERMISSION RESOLVER IN DEPTH A permission resolver is the part of the harness that answers a single question each time the agent wants to act: is this allowed? It receives a request describing the actor (who is asking), the action (what they want to do), and the resource (what it applies to), along with context such as the current task and the environment. It returns a decision, typically allow, deny, or ask a human. Think of it as a security checkpoint officer who checks a rulebook for every person who approaches.