Agent permission model

How a harness decides what an agent is allowed to do without asking first. The layer between the model’s intention and the machine’s filesystem, shell and network, and the part of an agentic coding harness that has nothing to do with making the agent better at its job.

The corpus holds one source on it, claude-code-auto-mode, and the shape it describes is a three-way trade between safety, throughput and attention.

The confirmation-fatigue result

The design most harnesses shipped first is per-action confirmation: the agent proposes, a human approves. It is easy to defend and it produces a number that is hard to defend — human reviewers caught 13.6% of harmful actions, against 89% for anthropic‘s automatic approval, across 1,053 paid developers.

The mechanism is not that the humans were careless. It is that a prompt asking for approval hundreds of times a session trains the person to dismiss it, so the control degrades in proportion to how much the agent is used. A safety measure that fires constantly is a safety measure that stops being read, and the more useful the agent gets, the less protection the same design provides.

That result is worth keeping separate from the remedy. It stands on its own and it is bad news for every harness in this corpus that treats an approval prompt as its safety story.

What the automatic version moves rather than solves

Handing the decision to the model changes who is inattentive, not whether anything gets through. On the reported figures 11% of harmful actions still pass — now at machine speed, with no human in the loop by design rather than by fatigue.

Two things follow, and neither is settled by anything held here:

• A perfect injection score describes the attack set. 720 attempts, none successful, was measured against a suite chosen for the test and commissioned by the vendor being tested.
• The untested shape is the trusted one. Willison’s example is a malicious package whose instructions read as legitimate work. Adversarial-prompt suites test the agent’s resistance to something that looks like an attack; a supply chain delivers something that looks like the job.

Where this sits against the spoke’s thesis

The synthesis argues that the frontier model writes the code and the value moved into the wrapping. Permission is the clearest case of the wrapping doing work no model quality can do: a better model is not a more constrained one, and capability and authority are independent dials.

It is also the dial that runs the opposite way from every other one in this corpus. effort-level, orchestration and skills all exist to let the agent do more; the permission model exists to decide what it may do at all — and the direction of travel documented here is the same as everywhere else, toward removing the human from the loop.