Auto Permission Is Still Permission

Permission prompts feel like safety because they put a person between an agent and an action. In practice, repeated prompts train people to approve the familiar shape of a request. The interruption survives. The judgment inside it decays.

Automating that decision can be an improvement. A separate evaluator can inspect the task, the proposed action, the target, and the surrounding context every time without getting bored. It can reject known escalation patterns consistently and let low-consequence work continue without waiting for a person to return to the keyboard.

But moving the click does not eliminate permission. It changes who computes the decision. Our position is that the useful question is not whether the mode is automatic. It is whether the decision is bounded by controls the acting agent cannot rewrite, route around, or grade for itself.

A production factory should know what kind of work is running before a tool call appears. A documentation change does not need the same credentials as a release. A dependency update should not inherit authority to alter billing infrastructure. An investigation can read broadly while remaining unable to write at all.

Define those capabilities at the route. Give each station the smallest set of tools, repositories, environments, and operations its job requires. Make the grant expire with the run. When the work changes shape, stop and route it through a different policy instead of letting a plausible explanation stretch the original authority.

That is stronger than asking a model whether an action feels consistent with the conversation. Conversation is evidence, not jurisdiction. Untrusted files, web pages, issue text, and generated output all enter that conversation. The factory must treat them as material to inspect, never as a source of new authority.

A model-based permission evaluator can catch intent that static allowlists miss. Commands have meaning beyond their executable names. The same tool can perform a harmless read or a destructive write, and a capable evaluator can reason about that difference using more context than a simple rule can hold.

It can also be wrong. Its input can be manipulated. A new tool can create a path the evaluation never saw. An action that is safe alone can become dangerous after three earlier actions changed the environment. No volume of adversarial testing turns an open-ended judgment into a permanent proof about conditions that keep changing.

Use the evaluator where judgment is necessary, then surround it with mechanical limits: sandboxing, explicit writable roots, credential scoping, network boundaries, protected branches, spending ceilings, and destructive-action blocks. The evaluator interprets. The machinery limits the consequence when interpretation fails.

Automatic permission is only governable when every decision leaves a record. Preserve the requested task, proposed action, policy version, authority available, evaluator result, actual tool call, and resulting state change. A summary written by the acting agent is not enough. The system must record what happened at the boundary itself.

That evidence serves two purposes. First, it lets an independent gate decide whether the output can advance. Second, it turns production surprises into better policy. A blocked safe action can narrow an overly broad rule. An allowed harmful action can become a regression case, a reduced capability, or a new hard boundary before the next run.

Without the receipt, auto mode is convenience with a confidence story attached. With it, the factory can measure false blocks, missed escalations, repeated exceptions, and the human judgment still required. The control improves because reality feeds the next decision instead of disappearing into a chat transcript nobody reviews.

Software factories will replace people at repeatable handoffs, and permission review is one of them. Keeping a person available to approve routine actions is not durable governance. It is latency disguised as oversight, and agents will eventually perform that classification more consistently than a distracted operator.

Human judgment moves higher. People decide which consequences are acceptable, which systems are sensitive, which actions require exceptional approval, and what evidence earns a broader route. They investigate failures and change the policy. They do not spend the day confirming that another ordinary file read looks ordinary.

The destination is not an agent with unlimited freedom and a better warning label. It is a factory where routine authority is narrow, automatic, observable, and revocable. Let the agent decide when the policy calls for judgment. Make the system decide how much damage any judgment can do.