Layered Agent Permission Stack

Production harnesses layer execution policy, lifecycle hooks, LLM or human approval and OS sandboxing; cheap guardrails can run optimistically in parallel where early execution is harmless, and a reasoning-blind classifier can replace per-action human approval.

Evidence: moderate

No single permission mechanism is good enough on its own. Static policy cannot anticipate every command, human approval does not scale to hundreds of actions per run, and model judgement can be manipulated. Production harnesses therefore stack several mechanisms, and the stack is one of the seven harness subsystems. Where agent system-level defenses lists the kinds of control available, this note is about how real harnesses arrange them.

The Wavestone source-code study (arXiv 2609.00006, a 2026 preprint) compares these stacks. Aider and Mini-SWE-Agent have only cost and step budgets. Claude Code combines execution policy, lifecycle hooks and human approval. Codex has four layers: server-delivered Starlark policy, hooks, a large language model (LLM) approval reviewer and a native operating-system (OS) sandbox. OpenClaw's model is scope-based, tied to session and plugin. Only Codex and Gemini CLI have cross-platform native OS sandboxing. Meta's Muse Code cookbook adds a finer-grained policy layer, splitting compound shell commands into stages that are approved one by one, with a deny always beating an allow (see staged command approval).

Two design moves make the stack cheaper to run. OpenAI's practical guide describes guardrails as layered defences (relevance and safety classifiers, personal-data filtering, moderation, per-tool risk ratings, rules and output validation), and the Agents SDK can run input guardrails optimistically: the agent proceeds while tripwires run in parallel. Optimistic mode does not enforce a boundary. By the time a tripwire fires, the agent may already have consumed tokens and executed tools. Run any check that screens for unsafe input or actions in blocking mode, before the agent acts, and reserve parallel mode for checks where early tool execution is harmless. The guide names two triggers for human intervention, exceeded failure thresholds and high-risk actions. Anthropic's auto mode goes further and replaces the human approver with a two-stage transcript classifier, a fast single-token filter followed by chain-of-thought only on flagged actions. The classifier is "reasoning-blind" because Claude's messages and tool outputs are stripped from what it sees, so persuasive text cannot talk it round, and a separate input-side probe looks for injection in tool output (see inspect tool output before it enters context). Anthropic separately reports 84% fewer permission prompts once OS sandboxing was in place.

A plausible arrangement, from the bottom up: an OS or container boundary (contain at the environment layer first), an un-overridable floor of blocked actions (hardline command floor), then policy and approval tiers (human approval gates), which may differ between a read-only diagnosis worker and one allowed to act (diagnose by default, act by exception).

Sources

  • Wavestone, arXiv 2609.00006, §10 — https://arxiv.org/html/2609.00006v1
  • OpenAI, PDF, Guardrails section — https://cdn.openai.com/business-guides-and-resources/a-practical-guide-to-building-agents.pdf
  • OpenAI developer docs — https://openai.github.io/openai-agents-python/
  • Anthropic Engineering, 25 Mar 2026 — https://www.anthropic.com/engineering/claude-code-auto-mode
  • Anthropic Engineering, 25 May 2026 — https://www.anthropic.com/engineering/how-we-contain-claude
  • Meta Model API cookbook, Building with Muse Code, undated (retrieved 3 Oct 2026) — https://dev.meta.ai/docs/cookbook/staged-approvals