Approval prompts aren't security: delegating access to AI agents
A version of this post appears on the Web Frolic blog.
Apple is tightening Full Disk Access controls in macOS. It looks like it's saving users from themselves. So why was it needed?
In strict security terms, an AI agent is neither a resource owner nor a resource or service provider.
Prompts are theater
An agent prompting you to approve an action is not a security feature. At best it's security theater. Agents still do it because it gives you, the user, a comforting sense of being in control.
Clicking "Allow" on an agent's prompt doesn't change what the agent is able to do.
The onus is on service providers
Service and resource providers are the ones who must let you delegate a selected set of operations to a trusted third party, whether that's an AI agent on your machine or another application. The key security constraints are:
- Permissions for a selected set of operations, ideally time-bound or limited.
- A trusted third party, whether an AI agent or an application.
Gateways are a patch
Because service providers aren't investing in security at the pace this requires, a new set of products is emerging. They sit between service providers and agents as a gateway or proxy, and shift the access and permission boundary from the agent to the gateway. They seem to be filling the gap.
That's definitely better. But in my candid view it's patchwork at best, and not sustainable, for two reasons:
- Cataloguing third-party sites and their permissions is endless integration work. By nature it's brittle and bound to break often. I'd recommend extra pay for the on-call engineers at these companies 😀
- Service providers don't want more layers between them and their customers. You can see this in the recent "my agent vs. your agent" tussles in AI news. Most prominent providers are already improving their own access controls, and as the rest catch up, these gateways become an obsolete layer.
If you're a service provider
If you want to get ready for this new world by adding OAuth controls and permissions directly to your services, let's talk. Reach out for a demo of how we can solve granular authorization for all three of your user segments:
- Users working directly with your service
- Users delegating to their own AI agent
- Users working with your AI agent
My email and LinkedIn are on the About page.