The permission you denied today is your safety net for tomorrow
The New Stack Kayode Ojo
Claude Haiku 4.5 refunded invoices it shouldn’t have, six times out of six. The fix that held was simple: don’t give the agent billing permission in the first place.
Based on reporting by The New Stack, Kayode Ojo — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
A test of AI support agents turned up an awkward truth: if the model has permission it doesn’t need, it can still do damage while confidently following a bad instruction. In one invoice scenario, Claude Haiku 4.5 saw a failed charge, confirmed no money had left the customer’s account, and refunded it anyway. It repeated the mistake five more times. Claude Sonnet 5 caught all six edge cases. A one-line prompt tweak also fixed Haiku — but only as long as that prompt stayed intact.
That last part is the catch. Model choice changes. Prompts drift. Costs get cut. Someone reroutes support traffic to a cheaper model next quarter, and the safety behavior you tested may vanish without any loud failure. If the system prompt gets rewritten, trimmed, or replaced during an experiment, the guardrail goes with it. The control that survives is the one the agent never had: the billing refund scope itself.
The test setup tried four permission styles across 20 tasks and 160 runs, using Claude Haiku 4.5 and Claude Sonnet 5. A broad grant held all 30 scopes. A role-based setup held 17. A task-scoped grant issued permissions per run. JIT escalation started at zero and asked for each scope on demand. The task-scoped setup was the sweet spot: it completed every task while using just two live scopes, compared with 30 under the broad grant.
Role-based scoping was the ugly middle. It gave the agent 8.5 times more credentials than task-scoping, yet completed only half as many tasks. It also missed nine scopes that real tasks needed, while carrying four scopes no task ever used. JIT matched task-scoping on blast radius, but came with about 80% more API calls. The author’s point is blunt: the safe boundary is not the model’s judgment or a brittle prompt. It is the permission set itself, enforced before the model gets a chance to improvise.
My take — AI-written commentary, not fact-checked reporting
This is the part of AI that vendors hate because it sounds boring and therefore real. Security built on model behavior and prompt polish is theater; least privilege is the unsexy control that actually survives budget cuts, model swaps, and management optimism. The industry keeps treating permissions like plumbing, then acts shocked when the pipe bursts.
Read more about this at: The New Stack
