Why permissions come first

Most agent incidents we reproduce don’t need a clever prompt. They need a tool with more access than the task required.

The five mistakes

1. Write access where read would do

Default every tool to read-only and add writes one at a time.

2. Tenant ids supplied by the model

Bind tenant context to the session. A model should never choose whose data it sees.

3. Secrets in tool config

Tokens in MCP config files end up in repos and logs. Use short-lived credentials instead.

4. Unpinned tool descriptions

A description is an instruction. Pin it by hash and alert when it changes.

5. Tool output treated as trusted

Web pages, tickets and emails that come through a tool can carry instructions. Treat them as untrusted input.