Deny by Default: Permissions for Agents That Act
· 9 min read
CatalEx Engineering · Published July 12, 2026 · 09:00 UTC
A chatbot that says something wrong is embarrassing. An agent that sends something wrong is a fact about the world. The moment an agent can send, post, create, or delete, it stops being a text generator and becomes a principal in your system — with credentials and reach, taking actions other people receive.
The instinct at that point is to write a better system prompt. Tell the model to be careful. Tell it to confirm before sending. This doesn't work, and it doesn't fail in an exotic way — it fails because a system prompt is a suggestion addressed to the thing you're trying to constrain.