Capability, permission and authority
Three questions get confused in agentic systems:
- Capability. What can this component cause at all?
- Permission. Of those things, what may this actor do, under policy?
- Authority. Who can make a consequential decision binding?
A design is safe when the answers differ in the right places. The model should have a narrow capability and permission to propose, and no authority over the decision.
How each project draws the lines
| Capability (what can be caused) | Permission (who may do it) | Authority (who binds the decision) | |
|---|---|---|---|
| I · template | MCP tools on the agent's include: list. A granted tool that does not exist stops startup. Default: two read-only tools | the gateway-authenticated user; the MCP server's service key; apply_policy for mutations | the human, through a signed, single-use approval token verified at mutation (opt-in) |
| II · Sophos | Memory and Fetch MCP tools, whatever they can do | none beyond the local process: single user, local-first | none modelled. Approvals are a challenge |
| III · ETF Research | evaluation, search and three approval-gated actions | authenticated researcher; hard constraints | the deterministic engine produces the default; the human consents or overrides with a rationale; the backend recomputes |
| IV · Arktos | exactly four tools, none returning secrets and none signing | the API key that owns the wallet, resolved by HMAC lookup; it is never an argument | no tool carries value-moving authority. Key custody rests with the operator |
| V · Tauros | exactly eight reviewed Ash actions over MCP | Ash policies on every action, for every interface; per-agent ownership | a human approver who owns the proposing agent and names the exact revision and hash |
Three lessons from the comparison
Capability is the cheapest control, so make it narrow first. In Parts I,
IV and V, a model cannot do what no tool implements. Part I's anti-pattern of
giving the model database credentials and a run_sql tool
(Anti-patterns)
fails here before any policy runs. Arktos's statement that "no current tool
gives an agent the ability to move value" is a capability statement, and it is
enforced by a test that pins the tool list.
Permission must not live in the interface. Tauros's policies run inside the Ash actions, so the LiveView, the JSON:API, a direct call and an AshAI tool are all checked identically. Lesson 14, AI capability vs actor permission, shows the gap in the other direction: an action an agent is permitted to run but is not offered as a tool. Offering fewer tools than policy allows is fine. Relying on the offer as the only check is not.
Authority belongs to whoever can be held accountable, and must be checked where the change happens. In Parts I, III and V the decision is a human's, and in each the point of mutation verifies it independently of the conversation that produced it. A prompt injection can change what the model says, and even what an approval card shows. It cannot change the recomputation, the policy or the hash comparison. That guarantee is about the model. The trusted runtime around it holds real credentials (a service key, and in Parts I and III the approval signing secret), so a compromised runtime is a different and larger threat. See Keeping credentials from the model is not keeping them from the runtime. Tauros lesson 15, Prompt injection vs deterministic authority, and Part III's adversarial-data lesson make this concrete.
Where the boundaries are thinner than they look
- Guardrails are not authorisation. Part I says so explicitly (concept 4). A rail filters text; it does not decide who may act.
- An approver is not a second approver. In Tauros the human who owns an agent approves that agent's proposals. There is no four-eyes rule at the pinned revision.
- The runtime is a principal too. The agent process that talks to the model also holds the MCP service key and, in Parts I and III, the approval signing secret. "The model cannot mint a token" is true. "Nothing in the agent container can" is not.
- The operator is a principal too. In Arktos the model holds no secrets, but the operator holds the master keys and can decrypt a phrase deliberately (C1). "The agent cannot" is a weaker claim than "nobody can".
Exercise
For a system you work on, fill in the table above with one row. For each column, name the file and line that enforces it, and the test that would fail if it were removed.