13 posts tagged #permissions.
Decompose a reviewed spec into discrete tasks and drive it with a loop that spawns a fresh headless agent per task. Each unit of work gets a clean context window and a pass/fail gate instead of one agent compacting itself into confusion.
Not all code is equally expensive to get wrong. Stop reviewing your agent's output uniformly and start spending your scrutiny where a mistake double-charges a customer.
Taking the human out of the loop is the real unlock — but headless plus loose permissions plus production access is how you wake up to a wiped repo. Automate only what's tested, sandboxed, and scoped.
A destructive-tool annotation plus a mid-call elicitation request gives you a deterministic human checkpoint that travels with the capability — so a confused or injected instruction can't quietly delete your data, no matter which client is driving.
When a tool call lacks a parameter, the agent's two instincts — fail or guess — are both wrong. Have the server elicit the missing field against a JSON schema and turn a half-specified request into a clean, validated dialogue.
The dangerous MCP server isn't the malicious one — it's the convenient all-in-one that reads untrusted data and holds privileged access to a second system. Scope it, gate the writes, and you close the confused-deputy attack.
An MCP server is a trust boundary, not a passthrough. Hold every secret server-side and expose a curated verb set, so a prompt-injected agent is bounded by the tools you chose — not your full API surface.
Give every consequential tool a declared output schema and validate the result against it at the boundary, so the UI gates on a real success boolean instead of trusting the agent's prose — and a malformed result fails loud instead of rendering a lie.
Build your review as a headless command with an explicit tool allowlist, and the exact check you run by hand becomes the exact gate that runs on every pull request. One definition of 'acceptable,' two surfaces.
Reviewing irreversible actions after the fact is too late. Split tools by reversibility in permissions, force a plan, and gate the destructive step behind a human interrupt — autonomy on reads, a hard stop on anything you can't undo.
The blocker to running an agent overnight is never capability. It's trust. And you don't earn trust with a smarter model — you earn it with a smaller blast radius.
Prompt injection isn't an unsolvable model problem — it's a context-engineering one. Fence untrusted tool output as data in your rules, run a parallel guardrail hook that cancels on a hit, and cap the blast radius with a permissions allowlist.
Hand-writing an adapter for every external system is the contextless agent's biggest tax. An MCP server collapses the M×N integration blowup into one standard connection the agent discovers at runtime — scoped by permissions, configured once.