What an agent is allowed to do: permissions, access and approvals

An agent can only do what its tools allow. Permissions are the settings that decide which tools it may use, on what, and whether a person must say yes first. The agent's access is the sum of those settings plus whatever accounts you've connected to it.

Three layers of control

What's connected. Each tool is a door. An agent given a calendar tool can reach the calendar. An agent given a shell, which runs typed commands on a computer, can run commands¹. Anthropic's tool list includes ones that take screenshots and control the mouse and keyboard in a desktop environment¹. The wider the tools, the wider the reach.

Rules about use. Claude Code, Anthropic's coding agent, shows how a maker handles this. Its documentation says the settings let you specify exactly what the agent is allowed to do². It describes a tiered system meant to balance power and safety². Rules are checked in a fixed order: deny first, then ask, then allow². A broad deny rule blocks every matching call, even ones a narrower allow rule would cover².

Asking a person. Anthropic describes agents that stop to ask a person at checkpoints, or when they get stuck³. OpenAI goes further for tools connected through MCP. Its safety guide says to always enable tool approvals, so users can review and confirm every operation, reads and writes alike⁴.

Reading before writing

Read access and write access aren't the same risk. Looking at a calendar changes nothing. Deleting an entry, sending an email or paying an invoice does. Where a product lets you pick, you can start with read-only access and add more later. Check each product's own settings page, because the choices differ from one to the next.

What the makers warn about

OpenAI points out that a model may send more data to a connected tool than the user expected or intended. Guardrails help limit what's in context, but you don't have full control over what the model chooses to share⁴. Its advice is to use caution in what access you give agents and how you apply them⁴.

Anthropic recommends extensive testing in sandboxed environments, together with suitable guardrails³. A sandbox is a walled-off space where mistakes can't reach real accounts.

Practical points for a small business

• Never paste passwords, API keys or card numbers into a prompt. Customer records stay out too, unless your own business policy says otherwise.
• Where a product allows it, give the agent a login of its own. Then one switch cuts it off.
• Keep approval prompts on for actions that send, delete, pay or publish.
• Look over the connections now and then, and remove any that are idle.
• Rules about personal data differ by country. Check the official privacy regulator's guidance for yours.

Permissions don't make an agent right. They only limit the damage when it's wrong. The next page covers how agents go wrong.