Glossary
Permission Scope
The exact resources and actions available to a tool or identity.
Related guide: AI Agent Safety Terms in Market Tools. Updated 2026-09-17.
Permission Scope in context
A permission scope describes allowed actions on specified resources. 'Read-only' is incomplete unless you also know which data can be read. A tool that cannot edit files may still expose confidential information if it can read every directory.
Important boundary
Prompt instructions are guidance; permissions are an enforceable boundary.
Telling a model 'only read these reports' does not revoke broader credentials held by its tools. A prompt and an enforced authorization rule play different roles.
Worked example
The same read action, two very different boundaries
In a fictional document-review service, Worker A can read only three approved public reports. Worker B can read the whole company drive. Both are described as read-only, but only A's resource boundary matches the task. Neither worker needs payroll records to compare public reports.
Write down the intended rule as a small access table: read the approved report IDs, create a draft in the review folder, deny deletion, deny external sending. Test one allowed read and one read outside the list. If both succeed, the application has not enforced the intended scope, regardless of what its prompt says.
Now add a new report. Expanding the approved list changes one resource permission; granting whole-drive access changes the risk much more broadly. This example separates an action, a resource, and the place where the decision is enforced. It is a reasoning exercise, not a complete access-control implementation.
Continue in the guide
Designing an agent that can research but cannot silently trade
Read the complete applied scenarioKnowledge check
Check the distinction
A tool refuses deletion but can read private payroll data. Is it appropriately scoped for a public-report comparison?
No. Blocking deletion limits one action, but the readable resource set is still broader than the task requires. Restricting the approved report IDs addresses a different part of the boundary.
Source trail
Check the source or calculation
Reference for per-tool and resource-specific authorization. The two workers and their access table are our own illustrative exercise.