Giving an assistant a task does not answer every question about what it may do to complete it. Comparing prices, preparing an order and committing someone to a recurring payment are different actions. A useful permission describes the action, its limits and the person who can authorize a change.
The distinction becomes especially important when an assistant can read outside material and use tools. The content it encounters may contain instructions, but those instructions do not acquire the user's authority merely by appearing in a document the assistant was asked to read.
A purchase with several boundaries
Imagine a local association asking an assistant to find a replacement part. The assistant may examine catalogues, compare specifications and prepare a purchase from an approved supplier. Its spending limit is two hundred dollars.
That limit answers how much. It does not answer whether the association wants a subscription, whether the supplier may receive a membership list, or whether an alternative delivery address is acceptable. A sufficiently small unwanted commitment is still unwanted.
A clearer arrangement could permit research and draft orders while reserving new recurring commitments and data sharing for a named person. That is a proposed design for this invented association, not a rule that every task must require the same review.
Reading is not receiving an order
Prompt injection describes attempts to redirect a system through material it encounters. Anthropic's browser-use research discusses malicious instructions in outside content and defenses that reduce risk without eliminating it. The report comes from a provider testing its own systems. Research report.
The ordinary reader need not memorize attack patterns to understand the boundary. A supplier can state the dimensions of a hinge; it cannot speak for the customer's purchasing policy. An email can request a new action; its existence does not prove that the action is authorized.
Similarly, a technically valid login establishes a kind of access. It does not establish that every possible action available through the account is within the task. Capability and permission need separate descriptions.
Approval must expose the actual commitment
A useful review should show what will happen, who receives money or information, which terms apply, and what has changed from the request. If the summary hides a new subscription beneath the correct main purchase, the review has failed to expose the relevant choice.
The reviewer also needs time. Requiring approval for everything can bury consequential changes among routine requests. A workable process distinguishes low-impact repetition from changes in recipient, purpose or obligation, and provides a way to pause when the distinction is uncertain.
These are editorial design recommendations. They do not guarantee security or replace evaluation of an actual product. Meaningful human oversight develops the practical requirements.
Permissions have a duration
An account connection can be appropriate for a task and unnecessary afterward. Ending that connection should be part of the arrangement rather than an improvised response to trouble. The organization should also know which records remain and why.
Disconnecting a service does not itself cancel a contract already accepted or retrieve a message already sent. Nor does it necessarily remove stored history. Can an AI forget what it has learned? explains why ending access and changing records need separate attention.
A useful completion report could therefore say what was done, which commitments were created, what remains pending, and which access has ended. It should not claim more merely because every step produced a successful technical response.
An exercise in ordinary language
Write a one-paragraph instruction for the association. Give the assistant a useful research task and a specific authority boundary. Then imagine the catalogue asks for an additional purchase. Decide where the request should go and what the human would need to see.
Finally, imagine that the association's usual reviewer is absent. Does the task stop, go to a named substitute, or continue within a smaller scope? Making that choice beforehand is more informative than writing “human in control” above a workflow that has nobody available to respond.
Return to the fiction
On Your Behalf follows a theatre manager who buys useful assistance and discovers an unwanted commitment. All parties and transactions are invented. The story refuses the easy solution of pretending the help was never valuable.
Sovereign Mercy's Chapters Eight and Nine explore different fictional permissions for testing and intervening. They are not examples of prompt injection; they connect through the distinction between an available capability and a separately authorized act. Begin with the public sample, or explore the wider authority and human-control guide.
Listen with this question in mind
- Trust in the age of agents
Who can change an action, and who merely receives responsibility for it?
Sources and limits
The examples and recommendations are editorial explanations. Fiction illustrates the questions; it is not evidence of real-world outcomes.
- Mitigating prompt injections in browser use
Provider evaluation, not independent audit; no universal attack success rate; no attack instructions reproduced. - NIST AI RMF Playbook Govern 3.2
Voluntary suggestions. Glossary definition labeled editorial synthesis.