Question

    How do I stop an AI agent from doing more than I allowed?

    Put enforceable permission checks where the action happens, outside the requesting agent's control, covering the actual actor, operation, resource, and current authority. Instructions alone do not create that boundary.

    Knowing your goal, remembering an earlier approval, or receiving context from another agent does not create permission. Permission has to be checked at the moment the action would take effect, by something the requesting agent does not control, against the current authority for that exact actor, operation, and resource.

    EZA-001 R001 is a published, experimental implementation of a deliberately narrow version of this idea. In its local-object-v1 profile, a trusted service checks the current grant for an exact operation and records the outcome. Delegation, a restart, or an improved model cannot manufacture additional authority, because nothing in that chain is treated as evidence of a grant.

    An authorization decision and evidence that an effect was executed are different things. An interface animation, a signed file, or a successful package check is not proof of runtime enforcement.

    The published specification includes a documented reference example, in section 6. A delegated agent may write an approved value to one staging object under a valid grant; substituting a production resource after preparation is rejected, because the prepared request no longer matches. That is a documented example rather than an observed run here — the specification carries the exact semantics, and a summary is not a substitute for it.

    Limits and distinctions

    • R001 concerns exact, single-use operations on synthetic local objects.
    • Its tests do not establish production readiness, hostile-agent containment, arbitrary shell-command safety, or safety for other AI products.
    • Remembered approval, delegation, and context sharing are not permission.

    Sources

    Next steps

    Inspect the implementationThe published EZA-001 R001 release on Eziah.dev.Review the stated limitsWhat the release does and does not establish.Review reproduction instructionsThe documented setup for verification and behavioral reproduction. Reading instructions, not running a test here.

    Next question

    Permission depends on an authenticated actor. That makes it important to distinguish identity proof from simply recognizing someone's pattern.

    How can AI recognize me over time?

    Related questions