Permissions, Sandboxing, and Human Approval

Key jargon

Term	Plain-language meaning
Least privilege	Granting only the access needed for a specific task and duration.
Sandbox	An enforced execution boundary limiting files, network, processes, or other resources.
Approval gate	A pause requiring an authorized human decision before a sensitive action.
Blast radius	The maximum harm possible if a component fails or is compromised.

Key concepts

Permissions must be enforced by code or infrastructure, not by asking the model to behave.
Require approval according to consequence and reversibility, not merely because a model expresses uncertainty.

Concept map

flowchart LR
    A["Model requests capability"] --> B["Policy narrows permission"]
    B --> C["Sandbox contains execution"]
    C --> D["Human approves high impact"]

Control stack

Identity: who is requesting and which workload acts?
Scope: what resources and actions are allowed?
Isolation: what can execution reach if it behaves unexpectedly?
Preview: what exact effect is proposed?
Approval: does the current human authorize this effect now?
Commit: re-check state and policy at execution time.
Evidence: record outcome and any external effect identifier.

Standing permission is convenient but broad. Per-action approval is safer only when the preview is comprehensible and the reviewer has time and context. Automated reviewers also need evaluation.

Sandbox rule

Assume model-generated code and untrusted content can be hostile. Use disposable environments, no ambient credentials, restricted filesystem/network, resource limits, and explicit artifact export.

Exercise

Classify ten hypothetical tools as read-only, reversible write, destructive write, external communication, or financial/legal effect. Define approval and isolation for each.