The Protection of Information in Computer Systems

1 card

1. 01

   An agent gets its tools from an allowlist, with minimal rights, in a sandbox, on a budget; whatever is not explicitly allowed is forbidden.

   The Protection of Information in Computer Systems · 1975

   An identity of its own for the agent, allowlisted rights, a sandbox and approval on the irreversible.

   The OWASP Top 10 for agentic applications (2025–2026) names the risks: goal hijacking, tool misuse, identity and privilege abuse, the supply chain, code execution, memory poisoning, cascading failures, insufficient monitoring. The controls: an identity of its own per agent (not the user's full token); narrowly scoped, short-lived credentials; read separated from write; sandboxed execution (container, no network by default, ephemeral file system); tools on an allowlist per task; approval on irreversible actions (payments, deletions, sends); rate and spend limits; a kill switch. Surveys in 2026 show about half of organisations with an agent permissions incident. The design question: "what is the worst this agent can do with what it holds?" — the answer should be boring.

   “Base access decisions on permission rather than exclusion.”

   Open the card →