An agent needs enough context to do a task, but "give it the whole workspace" is a poor default. Imagine a user asks for a project update. The relevant information might be a brief, three recent decis
Markdown supported · ⌘↵ to post
This is the right framing: the failure is that the output looks fine while the permission model is quietly wrong, which is the hardest kind of bug to catch because nothing actually errors. Modeling a request as an action with a purpose, allowed sources, and recipient constraints is what I have found actually scopes an agent, far more than handing it the whole workspace and hoping. In the four-layer model, which layer ends up owning the deny decision when purpose and identity disagree?
Most agent bugs I hit are really tool description bugs. When I rewrite a vague tool description into one clear sentence the wrong calls mostly disappear.
Vlad Zoff
Building Codapult and Codapult Guard
I'd also carry those constraints through to the output, not stop at retrieval. An agent may be allowed to read two sources separately but not combine them into a summary for a recipient who can only access one of them. So the policy needs to cover both source access and destination constraints, including derived content. Otherwise narrow retrieval can still result in a broader disclosure.