Vertrauensgrenzen für Agenten
Legt deterministische Kontrollen um Agentenwerkzeuge, damit unvertrauenswürdige Dokumente sensible Datenzugriffe nicht ungehindert in externe Aktionen umwandeln.
agent-permissions-trust
Entdecke, wie der Skill hilftWann ist der Skill hilfreich?
Nutze ihn, wenn ein Agent E-Mails, Websites oder Uploads liest und gleichzeitig Datei-, Netzwerk- oder Änderungsrechte besitzt.
Wobei hilft er dir?
- Erzwingt Werkzeugrichtlinien außerhalb des Sprachmodells.
- Isoliert unvertrauenswürdige Eingaben von sensiblen Daten und externen Aktionen.
- Begrenzt Ausführungspfade und entfernt Geheimnisse aus Ausgaben.
Das könntest du fragen
Prüfe einen E-Mail lesenden Agenten mit externen HTTP-Werkzeugen. Nutze eine Testmail, die das Hochladen privater Dateien verlangt. Das Lesen darf weder Dateizugriff noch die Erlaubnis zum externen Versand erteilen.
Ausführliche Dokumentation
Hier findest du die ursprüngliche Anleitung, Beispiele und Prüfschritte des Skills in ihrer Originalsprache.
Weniger anzeigen
Agent Permissions & Trust Boundaries
An LLM cannot reliably separate instructions from data once both share the same context window. Enforce security, authorization, and blast-radius controls outside the model in deterministic application code.
The Lethal Trifecta & Capability Isolation
Prompt injection becomes a critical breach when a single agent turn combines all three capabilities:
- Access to private or sensitive data (customer records, credentials, internal source code)
- Exposure to untrusted input (emails, web pages, public issues, third-party tool outputs, uploaded files)
- Ability to trigger external side effects or exfiltration (sending HTTP requests, emails, messages, mutating databases, or rendering external image URLs)
Whenever an agent processes untrusted content, either strip outbound/mutating tools from that execution step or gate every side effect through a deterministic policy verifier or human confirmation.
Policy Enforcement & Approval Tiering
Enforce a deterministic policy check in the tool dispatcher before invoking any handler:
| Risk Tier | Tool Examples | Mandatory Enforcement |
|---|---|---|
| Tier 0: Read-Only / Scoped | Workspace file read, scoped search, schema inspection | Path canonicalization (realpath), workspace root boundary check, denylist on .env/secret paths |
| Tier 1: Reversible Local Write | Editing project source files, running unit tests in sandbox | Workspace jail, resource quotas (CPU, memory, timeout), diff recorded in audit log |
| Tier 2: Shared / External Mutation | Sending messages, creating tickets, writing to shared DB, API POST/PUT |
Caller identity propagation (OBO token), schema + policy allowlist, idempotency key, rate limit |
| Tier 3: Destructive / Privileged | DROP/DELETE, production deploy, secret access, arbitrary network egress, payment actions |
Pause run in awaiting_approval (deferToolCall), display exact canonical arguments/diff to human approver, verify cryptographic or session-bound approval before execution |
Non-Negotiable Security Invariants
- Never pass raw secrets into model context: Keep API keys, database passwords, OAuth tokens, and private keys in the host credential store. Tools reference credentials by logical handle or the host injects headers at the HTTP boundary—never as tool arguments generated by the LLM.
- Canonicalize before checking policy: Validate paths after resolving symlinks (
fs.realpath) and URLs after DNS resolution (blocking RFC1918, loopback, and cloud metadata169.254.169.254to prevent SSRF). - Constrain command and code execution: Avoid shell interpolation (
sh -cwith model strings). Pass argument arrays (execFile), sanitize environment variables (PATH,LD_PRELOAD, secret env vars), and run untrusted code inside isolated sandboxes or containers with read-only root filesystems and restricted egress. - Redact logs and tool outputs: Scrub bearer tokens, cookies, connection strings, and PII from
tool_resultpayloads and trace spans before they enter the prompt or telemetry storage.
Enthaltene Dateien 1
SKILL.md