{
  "apiVersion": "v1",
  "topic": {
    "id": "agent-permissions",
    "title": "What are agents allowed to touch?",
    "group": "Control and oversight",
    "summary": "Sandboxes, permissions, data access and approval prompts that limit what agents can reach and do.",
    "passages": 11,
    "url": "https://the-ai-record.com/topics/agent-permissions",
    "json": "https://the-ai-record.com/api/v1/topics/agent-permissions.json"
  },
  "passages": [
    {
      "id": "anthropic-run-on-auto-mode-classifier-instead-of-yes-2026",
      "text": "what we were realizing is if there's a person that's deciding yes or no every time, at some point, the person actually just stops reading, and they just say yes, yes, yes, because they're tired of pressing yes. … And our security people were also realizing this. And so … the thing that they started working on is, is there a way to route this to a classifier? So the classifier can decide. … It took many months to kind of get this to a mature state. And in the end, through EVALS, through red teaming, through pen testing, we're able to show that this is actually much safer. And so … at Anthropic, we run on Auto Mode, and we recommend this to all our customers, too.",
      "context": "Cherny is explaining why Anthropic's security team worked on routing permission decisions to a classifier.",
      "speaker": "Boris Cherny",
      "speakerId": "boris-cherny",
      "speakerUrl": "https://the-ai-record.com/people/boris-cherny",
      "speakerLevel": "leader",
      "role": "Creator and head of Claude Code, Anthropic",
      "voice": "person",
      "organization": "Anthropic",
      "organizationId": "anthropic",
      "organizationUrl": "https://the-ai-record.com/organizations/anthropic",
      "aiVendor": true,
      "work": {
        "title": "Agentic AI and the Future of Software Development: S3 E4 (AMD Advanced Insights, hosted by Mark Papermaster)",
        "type": "podcast",
        "date": "2026-07-29",
        "publisher": "AMD (YouTube)",
        "locator": "34:33",
        "url": "https://www.youtube.com/watch?v=eQ6tb7j3Z2U"
      },
      "grade": "C",
      "gradeMeaning": "An interview or press quote.",
      "verification": {
        "status": "verified",
        "meaning": "An independent second reader re-fetched the source and confirmed the wording.",
        "reviewedOn": "2026-11-06"
      },
      "topics": [
        "autonomy-and-oversight",
        "security",
        "agent-permissions"
      ],
      "functions": [
        "engineering",
        "security"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/anthropic-run-on-auto-mode-classifier-instead-of-yes-2026",
      "json": "https://the-ai-record.com/api/v1/passages/anthropic-run-on-auto-mode-classifier-instead-of-yes-2026.json"
    },
    {
      "id": "openai-we-take-stance-sandboxing-hurts-us-2026",
      "text": "We take a stance with the sandboxing that hurts us in terms of general adoption. However, we do not want to promote something that could be unsafe by default. As a dev, you can always go into your configuration and disable these settings if you want.",
      "context": null,
      "speaker": "Thibault Sottiaux",
      "speakerId": "thibault-sottiaux",
      "speakerUrl": "https://the-ai-record.com/people/thibault-sottiaux",
      "speakerLevel": "leader",
      "role": "Head of Codex",
      "voice": "person",
      "organization": "OpenAI",
      "organizationId": "openai",
      "organizationUrl": "https://the-ai-record.com/organizations/openai",
      "aiVendor": true,
      "work": {
        "title": "How Codex is built",
        "type": "press",
        "date": "2026-02-17",
        "publisher": "The Pragmatic Engineer",
        "locator": "2. Technology and architecture choices",
        "url": "https://newsletter.pragmaticengineer.com/p/how-codex-is-built"
      },
      "grade": "C",
      "gradeMeaning": "An interview or press quote.",
      "verification": {
        "status": "verified",
        "meaning": "An independent second reader re-fetched the source and confirmed the wording.",
        "reviewedOn": "2026-11-04"
      },
      "topics": [
        "autonomy-and-oversight",
        "where-agents-run",
        "agent-permissions"
      ],
      "functions": [
        "engineering"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/openai-we-take-stance-sandboxing-hurts-us-2026",
      "json": "https://the-ai-record.com/api/v1/passages/openai-we-take-stance-sandboxing-hurts-us-2026.json"
    },
    {
      "id": "nordic-corporate-bank-agent-tried-to-get-customer-data-2026",
      "text": "How do we dare to do this in a bank? Well, we have the rules built in, and he doesn't have access to the customer data … And then he really tried to get the customer data. He tried to look at the … infrastructure and construct the connection string and all that, but we don't have secrets in our connection strings … managed identity to connect to the database, and his service principal … not have access to the database, so he couldn't get any data.",
      "context": "Asked how the team dares to run an autonomous agent in a bank, the speaker describes a test in which he tried to get the agent to hand over production customer data.",
      "speaker": "Hallstein Brøtan",
      "speakerId": "hallstein-brotan",
      "speakerUrl": "https://the-ai-record.com/people/hallstein-brotan",
      "speakerLevel": "practitioner",
      "role": "Senior consultant, Novanet; developer on Nordic Corporate Bank's system",
      "voice": "person",
      "organization": "Nordic Corporate Bank",
      "organizationId": "nordic-corporate-bank",
      "organizationUrl": "https://the-ai-record.com/organizations/nordic-corporate-bank",
      "aiVendor": false,
      "work": {
        "title": "How We Built an Autonomous Development Workflow at Nordic Corporate Bank",
        "type": "talk",
        "date": "2026-06-29",
        "publisher": "NDC Conferences (YouTube); talk recorded at NDC in Oslo",
        "locator": "23:32",
        "url": "https://www.youtube.com/watch?v=p8M8--12h1Y"
      },
      "grade": "B",
      "gradeMeaning": "The organization's own post, paper or talk.",
      "verification": {
        "status": "reported",
        "meaning": "Not yet confirmed against the source by an independent second reader."
      },
      "topics": [
        "agent-permissions",
        "regulated-ai",
        "security"
      ],
      "functions": [
        "engineering",
        "security",
        "risk"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/nordic-corporate-bank-agent-tried-to-get-customer-data-2026",
      "json": "https://the-ai-record.com/api/v1/passages/nordic-corporate-bank-agent-tried-to-get-customer-data-2026.json"
    },
    {
      "id": "coatue-agents-should-see-what-humans-see-via-api-2026",
      "text": "Very simple philosophy. We use our screens. We look at stuff. We do work. Every single thing that a human can see in pixels on the screen, an agent in your building should be able to see via API. The analogy I use is imagine you brought the smartest people ever, the greatest investors alive, and you brought them into your company, but you gave them a computer without logins to 75% of your services. It's almost immaterial how smart … system is if it doesn't have the tools to actually action that.",
      "context": "Long is describing the inputs an agent needs to do investing work, the first part of his framework.",
      "speaker": "Frank Long",
      "speakerId": "frank-long",
      "speakerUrl": "https://the-ai-record.com/people/frank-long",
      "speakerLevel": "practitioner",
      "role": "Works at Coatue",
      "voice": "person",
      "organization": "Coatue",
      "organizationId": "coatue",
      "organizationUrl": "https://the-ai-record.com/organizations/coatue",
      "aiVendor": false,
      "work": {
        "title": "AI Agents Will Upend Investing Even More Than Coding - Frank Long, Coatue",
        "type": "talk",
        "date": "2026-11-06",
        "publisher": "AI Engineer (YouTube)",
        "locator": "01:36",
        "url": "https://www.youtube.com/watch?v=AYFcmnQrZCg"
      },
      "grade": "B",
      "gradeMeaning": "The organization's own post, paper or talk.",
      "verification": {
        "status": "verified",
        "meaning": "An independent second reader re-fetched the source and confirmed the wording.",
        "reviewedOn": "2026-11-06"
      },
      "topics": [
        "context-for-agents",
        "agent-permissions"
      ],
      "functions": [
        "company-wide"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/coatue-agents-should-see-what-humans-see-via-api-2026",
      "json": "https://the-ai-record.com/api/v1/passages/coatue-agents-should-see-what-humans-see-via-api-2026.json"
    },
    {
      "id": "steve-yegge-fourteen-mechanical-fences-agents-first-class-2026",
      "text": "There is structure: doctrine and policy, human gates, and just fourteen mechanical “fences” (programmatic denials). But my agents are first-class colleagues. They work under my own identity, signing their own names to the work, and they can see the whole system and act independently. It is YOLO mode scaled up to the size of a small company.",
      "context": null,
      "speaker": "Steve Yegge",
      "speakerId": "steve-yegge",
      "speakerUrl": "https://the-ai-record.com/people/steve-yegge",
      "speakerLevel": "executive",
      "role": "Independent; builds and runs Wheelhouse, a solo multi-agent software factory (2026)",
      "voice": "person",
      "organization": "Steve Yegge (independent)",
      "organizationId": "steve-yegge",
      "organizationUrl": "https://the-ai-record.com/organizations/steve-yegge",
      "aiVendor": true,
      "work": {
        "title": "The Counting House",
        "type": "post",
        "date": "2026-10-27",
        "publisher": "Medium (Steve Yegge)",
        "locator": "Wheelhouse Recap",
        "url": "https://steve-yegge.medium.com/the-counting-house-steve-yegge-83f5145cc35b"
      },
      "grade": "B",
      "gradeMeaning": "The organization's own post, paper or talk.",
      "verification": {
        "status": "verified",
        "meaning": "An independent second reader re-fetched the source and confirmed the wording.",
        "reviewedOn": "2026-11-07"
      },
      "topics": [
        "autonomy-and-oversight",
        "agent-permissions"
      ],
      "functions": [
        "engineering"
      ],
      "figures": [
        {
          "metric": "mechanical-fences",
          "value": 14,
          "unit": "fences",
          "period": "2026",
          "definition": "Programmatic denials in the author's Wheelhouse system, besides doctrine, policy and human gates",
          "level": "n/a"
        }
      ],
      "url": "https://the-ai-record.com/passages/steve-yegge-fourteen-mechanical-fences-agents-first-class-2026",
      "json": "https://the-ai-record.com/api/v1/passages/steve-yegge-fourteen-mechanical-fences-agents-first-class-2026.json"
    },
    {
      "id": "monzo-we-are-bank-regulated-environment-non-determinism-agents-controlled-2026",
      "text": "Again, we are a bank. We live in a regulated environment. So, we want to make sure that the non-determinism from the agents is controlled. But at the same time, we want to have an environment where we can let it run loose and develop.",
      "context": "Felisola Caso is explaining why Monzo's agents run in a sandbox in an isolated namespace, separate from production infrastructure.",
      "speaker": "Felippe Felisola Caso",
      "speakerId": "felippe-felisola-caso",
      "speakerUrl": "https://the-ai-record.com/people/felippe-felisola-caso",
      "speakerLevel": "practitioner",
      "role": "Monzo (conference affiliation, 2026)",
      "voice": "person",
      "organization": "Monzo",
      "organizationId": "monzo",
      "organizationUrl": "https://the-ai-record.com/organizations/monzo",
      "aiVendor": false,
      "work": {
        "title": "A Bank Built Its Own Coding Agent. It Took Off (talk, AI Engineer)",
        "type": "talk",
        "date": "2026-10-20",
        "publisher": "AI Engineer (conference organizer) YouTube channel",
        "locator": "6:50",
        "url": "https://www.youtube.com/watch?v=adfw3xJBx1o"
      },
      "grade": "B",
      "gradeMeaning": "The organization's own post, paper or talk.",
      "verification": {
        "status": "verified",
        "meaning": "An independent second reader re-fetched the source and confirmed the wording.",
        "reviewedOn": "2026-11-06"
      },
      "topics": [
        "where-agents-run",
        "autonomy-and-oversight",
        "agent-permissions",
        "regulated-ai"
      ],
      "functions": [
        "engineering"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/monzo-we-are-bank-regulated-environment-non-determinism-agents-controlled-2026",
      "json": "https://the-ai-record.com/api/v1/passages/monzo-we-are-bank-regulated-environment-non-determinism-agents-controlled-2026.json"
    },
    {
      "id": "openai-dots-production-guardrails-own-hardware-2026",
      "text": "It has access to some production systems with guardrails, you know? So we built, we talked about specialist dots, but specialist dots is just like, operate with additional guardrails, additional monitoring, and then, you know, on their own hardware. So we actually run some on … The fundamental difference in the way that we've built dots is like, the harness does not run on the machine, you know? And then this is like, maybe people have not realized. It's like, it can connect to as many devices as you want. So it has its own computer. You can actually connect it to your own laptop as well. Over time, you might connect it to like, 10 different devices and it can control it all, a little bit like an octopus.",
      "context": "Asked whether his Dots agent has access to OpenAI's production code, Sottiaux describes the guardrails and where specialist Dots run.",
      "speaker": "Thibault Sottiaux",
      "speakerId": "thibault-sottiaux",
      "speakerUrl": "https://the-ai-record.com/people/thibault-sottiaux",
      "speakerLevel": "leader",
      "role": "Head of ChatGPT and Codex, OpenAI",
      "voice": "person",
      "organization": "OpenAI",
      "organizationId": "openai",
      "organizationUrl": "https://the-ai-record.com/organizations/openai",
      "aiVendor": true,
      "work": {
        "title": "OpenAI's Head of ChatGPT: We're entering a new era of AI (again)",
        "type": "podcast",
        "date": "2026-10-04",
        "publisher": "Lenny's Podcast (YouTube)",
        "locator": "21:47",
        "url": "https://www.youtube.com/watch?v=MM-C3JqCXBk"
      },
      "grade": "C",
      "gradeMeaning": "An interview or press quote.",
      "verification": {
        "status": "reported",
        "meaning": "Not yet confirmed against the source by an independent second reader."
      },
      "topics": [
        "where-agents-run",
        "agent-permissions",
        "autonomy-and-oversight"
      ],
      "functions": [
        "engineering",
        "security"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/openai-dots-production-guardrails-own-hardware-2026",
      "json": "https://the-ai-record.com/api/v1/passages/openai-dots-production-guardrails-own-hardware-2026.json"
    },
    {
      "id": "dropbox-same-schedule-action-user-scheduler-agent-validation-2026",
      "text": "Whether a request comes from a user, the automated scheduler, or an agent, the same Schedule Action type is used, including the same validation and commit process.",
      "context": null,
      "speaker": null,
      "speakerId": null,
      "speakerUrl": null,
      "speakerLevel": null,
      "role": null,
      "voice": "organization",
      "organization": "Dropbox",
      "organizationId": "dropbox",
      "organizationUrl": "https://the-ai-record.com/organizations/dropbox",
      "aiVendor": false,
      "work": {
        "title": "Evolving our calendar assistant Reclaim to be AI-native without starting over",
        "type": "post",
        "date": "2026-09-29",
        "publisher": "Dropbox.Tech",
        "locator": "Making calendar changes consistent and reviewable",
        "url": "https://dropbox.tech/machine-learning/evolving-calendar-assistant-reclaim-to-be-ai-native"
      },
      "grade": "B",
      "gradeMeaning": "The organization's own post, paper or talk.",
      "verification": {
        "status": "reported",
        "meaning": "Not yet confirmed against the source by an independent second reader."
      },
      "topics": [
        "agent-permissions",
        "autonomy-and-oversight"
      ],
      "functions": [
        "engineering"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/dropbox-same-schedule-action-user-scheduler-agent-validation-2026",
      "json": "https://the-ai-record.com/api/v1/passages/dropbox-same-schedule-action-user-scheduler-agent-validation-2026.json"
    },
    {
      "id": "amazon-isolation-reduce-blast-radius-sandboxes-2026",
      "text": "The isolation philosophy comes from two things, right? First, we obviously want to reduce the blast radius if a agent goes haywire. That's mainly provided by running these in isolated sandboxes. That can obviously be in Docker or in containers, that can also be on separate EC2 instances. However, you like to manage your isolation.",
      "context": "Vaidya, an AWS solutions architect, is describing and demoing a dark factory (software built and merged by agents) that he built himself, which he calls \"my factory\"; it is not presented as an AWS product. The talk is from the Background Agents Summit, recorded 7 May 2026 and published by Ona.",
      "speaker": "Shardul Vaidya",
      "speakerId": "shardul-vaidya",
      "speakerUrl": "https://the-ai-record.com/people/shardul-vaidya",
      "speakerLevel": "practitioner",
      "role": "Solutions Architect, Data and AI, AWS",
      "voice": "person",
      "organization": "Amazon",
      "organizationId": "amazon",
      "organizationUrl": "https://the-ai-record.com/organizations/amazon",
      "aiVendor": true,
      "work": {
        "title": "Dark Factories: Verification-First Agentic Engineering",
        "type": "talk",
        "date": "2026-05-07",
        "publisher": "Background Agents Summit (YouTube)",
        "locator": "16:11",
        "url": "https://www.youtube.com/watch?v=e7AvdrxsbaU"
      },
      "grade": "B",
      "gradeMeaning": "The organization's own post, paper or talk.",
      "verification": {
        "status": "reported",
        "meaning": "Not yet confirmed against the source by an independent second reader."
      },
      "topics": [
        "where-agents-run",
        "agent-permissions"
      ],
      "functions": [
        "engineering"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/amazon-isolation-reduce-blast-radius-sandboxes-2026",
      "json": "https://the-ai-record.com/api/v1/passages/amazon-isolation-reduce-blast-radius-sandboxes-2026.json"
    },
    {
      "id": "ramp-agent-definitions-live-version-control-move-2026",
      "text": "We took inspiration from Terraform: agent definitions should live in version control and move through the same review and deployment process as the rest of the product. An agent’s instructions, model, tools, and environment are declared in code, and our deployment pipeline registers changes with Laminar.",
      "context": null,
      "speaker": "Sam Kronick",
      "speakerId": "sam-kronick",
      "speakerUrl": "https://the-ai-record.com/people/sam-kronick",
      "speakerLevel": "practitioner",
      "role": "Author of Ramp's \"Building Laminar\" engineering blog post",
      "voice": "person",
      "organization": "Ramp",
      "organizationId": "ramp",
      "organizationUrl": "https://the-ai-record.com/organizations/ramp",
      "aiVendor": false,
      "work": {
        "title": "Building Laminar: Ramp's Managed Agents Platform",
        "type": "post",
        "date": "2026-10-20",
        "publisher": "Ramp Builders blog",
        "url": "https://builders.ramp.com/post/building-laminar"
      },
      "grade": "B",
      "gradeMeaning": "The organization's own post, paper or talk.",
      "verification": {
        "status": "verified",
        "meaning": "An independent second reader re-fetched the source and confirmed the wording.",
        "reviewedOn": "2026-11-07"
      },
      "topics": [
        "internal-tools",
        "agent-permissions"
      ],
      "functions": [
        "engineering"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/ramp-agent-definitions-live-version-control-move-2026",
      "json": "https://the-ai-record.com/api/v1/passages/ramp-agent-definitions-live-version-control-move-2026.json"
    },
    {
      "id": "monzo-key-infrastructure-us-spawn-sandboxed-container-would-2026",
      "text": "the key infrastructure for us to spawn a sandboxed container that would run an agent",
      "context": null,
      "speaker": null,
      "speakerId": null,
      "speakerUrl": null,
      "speakerLevel": null,
      "role": null,
      "voice": "organization",
      "organization": "Monzo",
      "organizationId": "monzo",
      "organizationUrl": "https://the-ai-record.com/organizations/monzo",
      "aiVendor": false,
      "work": {
        "title": "Building Agent Chip: Monzo's in-house agentic tool",
        "type": "post",
        "date": "2026-08-13",
        "publisher": "Monzo blog",
        "url": "https://monzo.com/blog/building-agent-chip"
      },
      "grade": "B",
      "gradeMeaning": "The organization's own post, paper or talk.",
      "verification": {
        "status": "verified",
        "meaning": "An independent second reader re-fetched the source and confirmed the wording.",
        "reviewedOn": "2026-10-31"
      },
      "topics": [
        "where-agents-run",
        "agent-permissions"
      ],
      "functions": [
        "engineering"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/monzo-key-infrastructure-us-spawn-sandboxed-container-would-2026",
      "json": "https://the-ai-record.com/api/v1/passages/monzo-key-infrastructure-us-spawn-sandboxed-container-would-2026.json"
    }
  ],
  "notice": [
    "Every passage is reproduced word for word from the cited source.",
    "Check the verification status: \"reported\" means not yet confirmed by an independent second reader.",
    "Organizations flagged aiVendor sell AI tools or services and have a reason to publish flattering numbers.",
    "An empty result means the archive holds nothing on it, not that nobody has said anything."
  ]
}