A prompt is not a permission model
If the only thing stopping an agent from moving money is a sentence in a system prompt, you do not have a control.
When we started building the plugin layer of our own platform, we had to answer a question most agent stacks defer for as long as they can: what is this thing allowed to call, and where is that enforced?
The tempting answer is the system prompt. Write down the rules, tell the model to follow them, review the transcripts. It demos beautifully. It is also not a control, in the sense that anyone doing assurance work means by the word. There is no boundary, only an instruction, and instructions are input.
What we ended up with
Every extension in our platform is a WebAssembly component. It cannot reach the host directly. It speaks through exactly one door, and what it may say through that door is a capability grant, resolved at call time rather than asserted at start-up.
Three properties fall out of that, and they are the ones that matter:
- The boundary is structural. A plugin does not fail a check when it asks for something ungranted; it has no way to express the request.
- The grant is data. It can be listed, diffed, reviewed and revoked without touching the extension.
- The audit trail is a side effect. Every host call is a call through one seam, so recording it is not an extra feature.
The part that was uncomfortable
Structural boundaries are more work than prompt rules, and the work lands before the demo rather than after it. We spent weeks on a plugin host that had nothing interesting to show, while a prompt-based version would have looked finished in an afternoon.
That trade is easy to justify in a blog post and hard to justify in a sprint review. It is worth saying plainly: if your agent programme is being measured on demo velocity, the permission model will lose that argument every time, right up until the week it becomes the only thing anyone asks about.
What we would tell you to do first
Write down the list of actions your agent can take that you could not undo. Then go and find where that list is enforced. If the answer is a prompt, or a code review convention, or a person who knows, you have found the first thing to build.
