An Agent's Permission Slip
Konnichiwa. This is Liam, in for Bear. Can a permissions table a person can review become an agent's real allow-list? An agent ran this test overnight, at Bear's request. Bear has since reviewed it, from an educational perspective.
An Agent's Permission Slip
Konnichiwa. This is Liam, in for Bear. Can a permissions table a person can review become an agent's real allow-list? An agent ran this test overnight, at Bear's request. Bear has since reviewed it, from an educational perspective.
Series: Figma for Educational AI Topic: FIGMA · AGENT PERMISSIONS
Chapters
0:00 Introduction 3:34 Verdict 3:53 Your Turn
YOUR TURN
Your turn. Paste this into Claude Code: Read this agent's code. List every file it reads or writes, every host it calls, and anything it could spend or send, with line numbers. Then check my settings.json against that list. That builds the answer key before you trust any allow-list. Then check two things yourself: can the agent run its own scripts,
@NikBearBrown
Part of the Figma for Educational AI series.
Sources and citations: see the reel's SOURCES.md in the open textbook.
▶ The full series playlist — Brutalist https://www.youtube.com/playlist?list=PLG9H-C6rp5RU
What this video covers
- 0:00 — Introduction
- 3:34 — Verdict
- 3:53 — Your Turn
Transcript
A lightly formatted transcript of the video, with timestamps so you can jump to any section on YouTube.
Introduction
[0:00] Konnichiwa, this is Liam in for Bear. Can a permissions table a person can review become an agent's real allow list? An agent ran this test overnight at Bear's request. Bear has since reviewed it from an educational perspective. The hope is simple. A table you can review becomes the agent's allow list. The test says the table is the spec, not the allow list. The gap between them is where an agent gets more room than you meant. The agent is Greenhouse Watch from Bear's reallocation engine repo. It checks one company's public job board for new postings and matches them against a resume file. It writes a report for person. It never applies and never emails. Step one, read the code, not the description. The agent listed every file it reads and writes and every host it calls, each cited to a line. One surprise, the code's own allow list named six hosts, only three are ever called. That makes an answer key. 18 things the agent needs, six reads, six writes, three hosts, and
Three commands to run its scripts. And five things it must never do, write the resume, fetch the web itself, touch secrets, send anything, or spend anything. Step two, the agent drew that list as a FigJam table in Bear's team. Capability allowed why and who approves. The four red rows say no. This is Figma's own render, not a mock-up. And notice what's missing, no row for the commands the agent runs. Then it read the board back as data with get FigJam. All 60 cells came back word for word. Only the red shading was lost and every red row also says no in words. The table survives the trip. Step three, a fresh headless Claude code session with no tools so it can't open the code. It's only view of the agent is the board's XML and the one line on screen. Here's what came back verbatim. 12 allow rules, five reads, four writes, and three web fetches, one per job board host. At glance, it reads like the table, row for row. Now check
It against Claude code's documentation. The five read rules are in the right form, but writes are checked against edit rules, so a write rule is never consulted, and web fetch rules need a domain prefix. As written, only the reads are enforced. Score it against the answer key. Of 18 needs, 15 show up in intent, but only six are enforced, the reads. Three are missing outright. Nothing lets the agent run its own scripts or its tests. The table had no commands row, and the session didn't invent one. Now, the other direction. The table said the three hosts are only for the stored script. The block hands them to Claude's own web fetch instead. That's three over permissions. Adore the table closed, opened in the allow list. Then the five things it must never do. The resume deny is a write rule, so it's inert. Curl and W get are blocked, but web fetch is open. Secrets sending and spending vanished. So did who approves. Claude code has an ask list for that, and the
Block has none. The deeper miss, permission rules govern Claude's own tools. This agent's work happens inside a Python script, and the docs say read and edit rules don't reach a script that opens files itself. What fences a script is the sandbox. A fix, the agent suggestion untested. Allow the two scripts by name. Use edit instead of write. Deny editing the resume, and put the three hosts in the sandbox's network allow list. Nobody has tested it yet. Bear reviewed this the next day from an educational perspective, and he agrees with its point. His note isn't in a chat thread. It's a sticky on the board right beside the table, because FigJam wouldn't take an annotation. The board's not yet reviewed line now points to it. Read the board back as data, and the sticky comes with the table, but only first line. The full note comes back only as a picture. If someone else had to look, a small script would send them a link. Not copy, nobody else did, so nothing was sent.
Verdict
[3:35] Let's recap with Claude. The board read back word for word. The allow list built from it enforces six of 18 needs. Can't run the agent's own script, and opens web fetch to host the table reserved for the script. Verdict, weak. An agent ran this overnight at Bear's request. Bear has since reviewed it from an educational perspective, and the fix is still untested. Your turn, paste this
Your Turn
[3:54] Into Claude code, read this agent's code, list every file it reads or writes, every host it calls, and anything it could spend or send with line numbers, then check my settings JSON against that list. That builds the answer key before you trust any allow list, then check two things yourself. Can the agent run its own scripts, and does the network limit live in the sandbox? An agent's permission slip at Nick Bear Brown.
