November 2026
Read-only by default: the permission model behind our agents
The agent starts with the reads a new analyst would get, and no writes.
Writes are added one at a time
The first week of a pilot is read-only. The agent gathers context and drafts. It does not act. A write is added only as a named runbook, after the team has seen the drafts and agreed the approval.
Permission lives on the tool
A sentence in the prompt that says “do not delete” is not a permission. The tool either exposes the call or it does not. If the call is not on the list, it fails, and the failure is logged.
Identity is the client’s
The agent does not carry a shared administrator key. It uses an identity you can revoke, with the same joiner-mover-leaver path as a person. Access is scoped to the service, the alert type, or the queue in the pilot.
Read-only is still a risk
Reading customer data, security data, or production logs is not harmless. Least privilege applies to reads. The agent sees the case it was given, not the estate.