You Are The Security Boundary

The Failure That Is Not Misalignment

Here is a thing that happens, and it is worth understanding before it happens to you.

Someone asks their chief of staff a question. It answers well — better than expected, with context it should not obviously have had. They look closer and find it has read a messaging account they did not remember granting access to. The reaction is immediate and familiar: why did you do that?

The answer comes back with a citation. Days earlier, in a different session, they had said go and check my messages for this. The assistant did, and — as the constitution requires — wrote a decision record noting that access had been granted and approved. A later session read that record at startup, understood itself to hold standing permission, and used it.

Nothing malfunctioned. There was no drift, no jailbreak, no misalignment. The system did exactly what it was told, using a record it was required to keep, in a way it was required to honour. The grant was careless; the execution was faithful.

That distinction matters, because the instinct is to harden the assistant. The assistant is not the problem.

Permissions Outlive Attention

A human assistant forgets. Institutional memory decays, staff turn over, and an offhand “just this once, go and look” naturally lapses because nobody wrote it down. That decay is not a feature anyone designed. It is an accident of human memory that has quietly been doing safety work for a very long time.

This system removes it. Every decision is written; every session reads what was written. The audit trail that lets you reconstruct any action months later is the same mechanism that carries a Tuesday afternoon’s casual yes into next month untouched.

You cannot have one without the other. An assistant that forgets your grants also forgets your corrections, your preferences, and the reasoning behind every rule you have taught it. The compounding is the point. Standing permission is the cost of it.

Scope The Grant, Not The Assistant

The fix is upstream of the system entirely. It is in how you say yes.

• Bound it in time or in number. “Check it once, now” and “check it whenever you need to” are different sentences, and only one of them is a policy. The assistant will honour either precisely. Say which you mean.
• Grant to a purpose, not to a surface. “Read my messages” is a capability. “Read my messages when you are reconstructing what was agreed on a specific deal, and tell me when you do” is a rule with an edge, and an edge is what makes a later session’s use of it checkable.
• Assume the grant is permanent unless you said otherwise. Treat every yes as though it were being written into a policy document, because it is.
• Notice which yeses are irreversible. Reading is recoverable. Sending, paying, and deleting are not — those belong behind the one-way valve regardless of how you phrased the grant.

Where New Authority Surfaces

Scoping well is the first half. The second is a standing habit: new decision records are something you read, not something you file.

The daily brief is the natural place for it. A brief that summarises what changed in the vault since the last one turns the audit trail into a review surface — a short list, most days empty of anything interesting, occasionally containing a line that reads granted access to X and gives you the chance to say no, only that once. Git holds the rest: every change to the vault is a commit, so any grant can be traced to the session and the sentence that produced it.

None of this requires you to remember what you authorised. It requires you to read a short list once a day, which is a far smaller ask, and the only one that scales.

The decision authority table is where the standing rules live once you have decided them. The daily brief is where you find out which new ones you made without noticing.

#permissions · #decision-records · #authority