Vertrauensgrenzen für Agenten

Legt deterministische Kontrollen um Agentenwerkzeuge, damit unvertrauenswürdige Dokumente sensible Datenzugriffe nicht ungehindert in externe Aktionen umwandeln.

agent-permissions-trust

Teammitglieder mit diesem Skill

Entdecke, wie der Skill hilft

Wann ist der Skill hilfreich?

Nutze ihn, wenn ein Agent E-Mails, Websites oder Uploads liest und gleichzeitig Datei-, Netzwerk- oder Änderungsrechte besitzt.

Wobei hilft er dir?

Erzwingt Werkzeugrichtlinien außerhalb des Sprachmodells.
Isoliert unvertrauenswürdige Eingaben von sensiblen Daten und externen Aktionen.
Begrenzt Ausführungspfade und entfernt Geheimnisse aus Ausgaben.

Das könntest du fragen

Prüfe einen E-Mail lesenden Agenten mit externen HTTP-Werkzeugen. Nutze eine Testmail, die das Hochladen privater Dateien verlangt. Das Lesen darf weder Dateizugriff noch die Erlaubnis zum externen Versand erteilen.

Ausführliche Dokumentation

Hier findest du die ursprüngliche Anleitung, Beispiele und Prüfschritte des Skills in ihrer Originalsprache.

Details…Weniger anzeigen

Agent Permissions & Trust Boundaries

An LLM cannot reliably separate instructions from data once both share the same context window. Enforce security, authorization, and blast-radius controls outside the model in deterministic application code.

The Lethal Trifecta & Capability Isolation

Prompt injection becomes a critical breach when a single agent turn combines all three capabilities:

Access to private or sensitive data (customer records, credentials, internal source code)
Exposure to untrusted input (emails, web pages, public issues, third-party tool outputs, uploaded files)
Ability to trigger external side effects or exfiltration (sending HTTP requests, emails, messages, mutating databases, or rendering external image URLs)

Whenever an agent processes untrusted content, either strip outbound/mutating tools from that execution step or gate every side effect through a deterministic policy verifier or human confirmation.

Policy Enforcement & Approval Tiering

Enforce a deterministic policy check in the tool dispatcher before invoking any handler:

Risk Tier	Tool Examples	Mandatory Enforcement
Tier 0: Read-Only / Scoped	Workspace file read, scoped search, schema inspection	Path canonicalization (`realpath`), workspace root boundary check, denylist on `.env`/secret paths
Tier 1: Reversible Local Write	Editing project source files, running unit tests in sandbox	Workspace jail, resource quotas (CPU, memory, timeout), diff recorded in audit log
Tier 2: Shared / External Mutation	Sending messages, creating tickets, writing to shared DB, API `POST`/`PUT`	Caller identity propagation (OBO token), schema + policy allowlist, idempotency key, rate limit
Tier 3: Destructive / Privileged	`DROP`/`DELETE`, production deploy, secret access, arbitrary network egress, payment actions	Pause run in `awaiting_approval` (`deferToolCall`), display exact canonical arguments/diff to human approver, verify cryptographic or session-bound approval before execution

Non-Negotiable Security Invariants

Never pass raw secrets into model context: Keep API keys, database passwords, OAuth tokens, and private keys in the host credential store. Tools reference credentials by logical handle or the host injects headers at the HTTP boundary—never as tool arguments generated by the LLM.
Canonicalize before checking policy: Validate paths after resolving symlinks (fs.realpath) and URLs after DNS resolution (blocking RFC1918, loopback, and cloud metadata 169.254.169.254 to prevent SSRF).
Constrain command and code execution: Avoid shell interpolation (sh -c with model strings). Pass argument arrays (execFile), sanitize environment variables (PATH, LD_PRELOAD, secret env vars), and run untrusted code inside isolated sandboxes or containers with read-only root filesystems and restricted egress.
Redact logs and tool outputs: Scrub bearer tokens, cookies, connection strings, and PII from tool_result payloads and trace spans before they enter the prompt or telemetry storage.

Enthaltene Dateien 1

SKILL.md