Permissions, sandboxing and audit logs: the boring part of AI agents that decides everything
There is a quiet consensus forming in the AI tooling world: permissions, sandboxing, auditability and policy are becoming core product requirements rather than features you add later.
It is the least exciting part of building an agent. It is also the part that decides whether anyone can responsibly use it.
Why it became urgent
An assistant that writes text can be wrong. An agent that runs commands can be destructive. Once a system can edit files, open applications, call services and spend money, the interesting question stops being how clever it is and becomes what happens when it is confidently wrong.
Confidently wrong is the normal failure mode of these systems. Not occasionally. Normally.
What a safe agent actually looks like
An allowlist, not a blocklist
The agent can do a named list of things. Anything not on the list is refused, not approximated. Blocklists fail because you cannot enumerate everything you did not think of.
No more privilege than the person using it
If it runs as an administrator, a mistake is an administrator mistake. Run it as a normal user and the worst case is bounded by what you could have done yourself.
Nothing listening on the network
If there is no open port, there is nothing to attack from outside. This costs you nothing until the day it saves you completely.
An audit log you can actually read
Not telemetry. A plain dated file recording what was proposed, what was approved, what happened and when. If you cannot reconstruct what an agent did last Tuesday, you do not control it.
A stop that always works
One key combination that halts everything, no matter what state the agent is in.
Refusing is a feature
The instinct when building these things is to make them helpful at all costs. That instinct is wrong.
An agent that says I could not map that to an allowed action is doing its job. An agent that finds something approximately similar and does that instead is the one that deletes the wrong folder.
Why we built it this way first
Serra runs as a normal user, opens no network port, works from an allowlist, writes every action to a dated log and stops on a key combination. None of that was added afterwards. It was the first thing built, before she could do anything at all.
That order matters. Safety added to a working agent is a patch. Safety built first is an architecture.
