Agent tool permissions need a deny list, not a prompt
Telling a model not to do something is not an access control.
An agent with a shell and a database credential can do anything those credentials allow. A sentence in the system prompt does not change that.
The workable pattern is a narrow tool surface with explicit scopes, plus an approval step for irreversible actions.
This is ordinary security engineering. The novelty is that the caller is probabilistic, so the defaults have to be stricter.
#training#datasets#agents
More in this section
🔒aiSubscriber
Why small models are winning on-device
Four-bit quantization plus better distillation is making 3B models genuinely useful in production.
ai
Synthetic data is hitting a wall nobody wants to name
Model collapse is real, but the more immediate problem is boring: attribution and licensing.
🔒aiSubscriber
The open-weights licence split is becoming permanent
Two families of licence, two incompatible expectations, and a lot of downstream confusion.