iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
AI agents should not decide their own authority from natural-language instructions. A safer design lets the model propose typed code while a compiler, capability library, and deterministic runtime boundary decide which files, APIs, processes, and delegated agents that code may use. I built around this idea with tacit (Tracked Agent Capabilities In Types), an MCP server that compiles agent-generated Scala 3 snippets with capture checking before execution. The result is narrower than a claim of “AI safety,” but it is practical: forged or missing permissions can fail before execution, selected computations can be prevented from exporting classified data, and every approved action can be logged and revoked.
What problem does capability-based security solve for AI agents?
Most agent frameworks place authority in an ambient environment: a tool list, process account, API key, or broad workspace mount. The model receives descriptions of those tools and decides when to call them. That arrangement is vulnerable to prompt injection, hallucinated plans, accidental misuse, and over-broad credentials. An allowlist can restrict tool names, but it may still permit a dangerous parameter or an unsafe sequence. A blocklist is harder to make complete, and repeated confirmation prompts train users to approve requests mechanically.
Capability security moves the decision to an execution boundary. A capability is a program value that represents authority over a particular resource or operation. Code must possess and pass that value to exercise the effect; it cannot simply name a file, open a socket, or invoke a process through ambient access. The model can still compose tools, but its generated program is checked against the authority it was actually given.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThe distinction is important: an agent permission is often a policy statement such as “the coding agent may use the repository.” A capability is the concrete, attenuated authority value that code must hold to perform one operation on one resource. That value can be scoped, delegated, logged, expired, and revoked.
#1 Best Overall
How does a typed capability layer work?
In the tacit design, the agent expresses an intention as Scala 3 code rather than calling unrestricted tools directly. Capture checking tracks which capabilities a computation captures. The generated snippet is compiled and checked, then run through a capability library that mediates files, processes, networks, and sub-agents.
As the paper puts it: “When agents express their intentions as typed code in a capability-safe language (here, Scala 3 with capture checking), the burden of proof shifts from the model to the compiler.” The model proposes code; the compiler and harness determine whether that code can exercise an effect.
Capability safety
Capability safety has two sides. First, code cannot forge a capability value, for example by constructing a file handle for a path it was never granted. Second, code cannot omit a required capability: a function that writes to a repository must declare and receive the repository-write authority. A generated program that violates either rule is rejected before it reaches the operating system or remote service.
Capability completeness
Static checks help only when every safety-relevant effect is behind the capability library. File reads, network connections, subprocess creation, database access, and child-agent delegation all need mediated facades. If generated code can call an unwrapped shell, import a library that opens arbitrary sockets, or reach a second API client outside the harness, that path becomes an escape route.
Local purity and information flow
Local purity lets you mark a computation as holding no capabilities. A pure function can transform an input value, but it cannot read a new resource, send a request, write a file, or invoke a subprocess. This is useful for classified data: the agent may be allowed to compute a redacted summary under a pure rule while being unable to transmit the original secret.
Rank #2
The paper describes the guarantee this way: “The type checker enforces that code cannot forge access rights, cannot perform effects beyond its budget, and cannot leak information from pure sub-computations, regardless of whether the code was written by a diligent engineer or hallucinated by a misaligned model.”
Can capabilities prevent prompt-injection damage?
They can prevent many unauthorized effects, but they do not make an agent immune to manipulation. A prompt injection may still cause the model to generate a harmful plan. The protection comes when that plan asks for an operation outside the capabilities attached to the generated code: compilation fails, or a deterministic guard refuses the call. A secret read in one step also cannot automatically become an authorized network upload if the subsequent computation lacks the required network capability and is constrained by local-purity rules.
This is stronger than trusting the model to recognize malicious instructions, yet it is not a complete information-flow proof for an incomplete harness. An unmediated tool, permissive serializer, or overly broad capability can still undermine the design. Runtime containment remains necessary for compiler bugs, library vulnerabilities, resource exhaustion, and failures that are not represented in the type system.
How do I give an agent access to one file or one API action?
Use attenuation: create the narrowest capability at the point where authority is granted, then pass only that value to the function that needs it. A repository capability might be narrowed to a single directory and read-only operations; an API capability might name one destination and one HTTP method rather than an entire credential.
- Define the resource boundary. Specify the exact file, repository subtree, database table, API operation, destination, and permitted parameters. Avoid a general-purpose shell or unrestricted root credential.
- Issue a typed capability. Bind the authority to a value whose type expresses the scope, such as read-only access to a named path or a single service method.
- Pass only the attenuated value. Give the capability to the function or child agent that needs it, not to the whole conversation or process.
- Prevent expansion. Delegated code may derive a narrower child capability, but it must not manufacture a broader one or convert read authority into write authority.
- Re-check at execution. A runtime guard should validate the capability, resource, parameters, and current revocation state immediately before the external call.
For a child agent, delegation should carry an explicit subset of the parent’s authority. If the parent can read one repository and call one API operation, the child should receive only the operation it needs, with a shorter lifetime when possible.
How would I build this security layer?
A useful implementation starts with the effect inventory, not with prompts. The following sequence covers the controls needed for a production-oriented prototype.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Inventory every effect. List tools, SDKs, environment variables, mounted paths, subprocesses, network destinations, databases, queues, and delegated agents. Include indirect channels such as logging, temporary files, and plugin systems.
- Define capability types. Create separate types for files, network destinations, processes, databases, and agent delegation. Encode operation, resource, parameter, and lifetime constraints instead of relying on comments.
- Expose typed facades. Replace unrestricted shell and generic API clients with wrappers that require the relevant capability value. Make unsupported operations unrepresentable where practical.
- Compile generated code in a restricted subset. Parse the agent’s Scala snippet, run capture checking, reject undeclared effects, and execute only code that passes the checker. Keep the compiler and capability runtime in a separately contained worker.
- Wrap sensitive values. Keep secrets and classified records inside wrappers such as
Classified[T]. Permit only approved pure transformations or explicitly authorized sinks; do not place the plaintext in the model’s conversation context. - Instrument and contain execution. Record the principal, capability scope, resource, action, parameters where appropriate, and a correlation ID. Apply timeouts, quotas, process isolation, network egress rules, and a kill switch.
The tacit implementation exposes this workflow through an MCP server. Classified values remain wrapped across turns, so a model can reason about a handle or derived result without receiving the underlying plaintext as ordinary conversation text.
What should be logged, audited, and revoked?
Every capability use should produce evidence that answers who acted, under which delegated authority, against what resource, for which action, and as part of which request. Log the principal or agent identity, capability identifier and scope, resource, operation, decision, timestamp, expiration, and correlation ID. Preserve denial events as well as successful calls; repeated denials can reveal an injection attempt or a broken workflow.
Revocation must be an operational path, not a field that exists only in a design document. Maintain an invalidation mechanism that runtime guards consult before each downstream action. Test the kill switch, invalidate outstanding tokens during an incident, and verify that already-running workers cannot continue to use revoked authority indefinitely. Short-lived capabilities reduce the exposure window but do not replace revocation.
Microsoft’s least-privilege guidance also calls for a unique dedicated agent identity, a named owner, a documented purpose and approved data access, review of aggregate permissions, deny-by-default tools and integrations, detailed action and scope logs, tested revocation, and re-review after material workflow or environment changes. Its broader governance guidance treats agents as systems that access data, make decisions, and act across business systems with delegated authority; a centralized baseline should cover identity, lifecycle, data governance, security, development standards, and observability.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #4
How does this approach compare with other agent controls?
No single control covers every failure mode. Compare alternatives by where they enforce a decision, whether they constrain information flow, how finely they scope authority, and what utility cost they impose.
| Approach | Enforcement point | Information-flow coverage | Typical granularity | Revocation and audit | Utility cost |
|---|---|---|---|---|---|
| Typed capabilities | Compiler/type checker plus runtime guard | Can reject missing or forged effects and constrain pure handling of classified values | Resource, operation, parameter, destination, and delegation | Capability lifetime, invalidation, and per-action evidence | Requires typed facades, code-generation constraints, and compiler/runtime integration |
| Runtime policy gateway | Deterministic decision before a tool or API call | Strong for calls it observes; earlier data flow may be opaque | Tool, resource, action, and parameters | Central policy logs and token checks; downstream re-checks still needed | Added latency and policy maintenance |
| Sandboxing | Process, container, or operating-system boundary | Limits reachable resources but may not explain how data moves between allowed tools | Filesystem, network, process, and device boundaries | Isolation events are auditable; fine-grained business intent is less visible | Operational complexity, escape risk, and resource overhead |
| Human approval | Person confirms a proposed action | Depends on what the reviewer can see; does not automatically prevent later leakage | Usually request or tool-call level | Approval records exist, but revocation after approval is separate | Latency and confirmation fatigue |
In practice, combine them. Type-level checks express what code may do, runtime guards re-check current policy and revocation, sandboxes contain unexpected failures, and human approval remains appropriate for high-impact actions.
What are the main implementation pitfalls?
- Leaving an escape hatch. A single unrestricted subprocess, plugin, or network client can bypass otherwise rigorous checks. Treat every library that performs I/O as part of the capability inventory.
- Granting a broad capability for convenience. “The whole project” or “any HTTPS destination” defeats attenuation. Start narrow and require an explicit elevation workflow.
- Confusing secrecy with authorization. Keeping a value out of the prompt helps, but a permitted tool can still disclose it. Pair wrappers with pure-computation rules and sink checks.
- Trusting static checks alone. Compiler soundness does not address denial of service, compromised dependencies, kernel vulnerabilities, or a policy change after compilation. Use quotas, isolation, runtime checks, and revocation.
- Logging too little. A record that says only “tool called” cannot support incident response. Capture scope, resource, action, principal, and correlation data while minimizing sensitive payload retention.
- Failing to test delegation. Attempt to pass a child agent a broader capability, reuse an expired token, alter a destination parameter, and continue after revocation. These negative tests should fail deterministically.
What evidence supports the capability-layer approach?
The tacit proof of concept, described by Odersky, Zhao, Xu, Bračevac, and Pham for CAIS 2026, reported no significant loss in task performance in its experiments while preventing unsafe information leakage and malicious side effects. That is a qualitative research result, not a universal benchmark for every agent workload or language implementation.
The central engineering claim is therefore bounded: moving authority checks into typed code and a deterministic harness can make important classes of unauthorized effects fail before execution, while preserving useful composition. The design still depends on complete mediation, correct wrappers, secure runtime containment, and governance around identity and lifecycle. No independent market-size or incident-rate statistic is needed to establish that mechanism, and none is established here.
Free tools Windows power users keep installed
One-click scans. No signup required.
What is Capframe’s role in this design space?
Capframe is a separate open-source implementation reference organized around three stages: “Find” the tool surface and injection gaps, “Bind” authority with scoped revocable capability tokens, and “Guard” every call with deterministic policy without an LLM in the security decision path. It illustrates the same enforcement principle from a runtime-token perspective rather than being the tacit type-system implementation. Evaluate its current code, deployment model, and licensing independently before adopting it.
What should an engineering team do first?
Choose one workflow with meaningful but bounded risk, such as read-only repository analysis or a single internal API operation. Inventory its effects, wrap each one, issue narrowly scoped capabilities, and add denial tests before connecting a general-purpose agent. Measure denied calls, approval or compilation latency, task completion, data exposure paths, and recovery time after revocation. Expand only when the logs and negative tests show that every relevant effect is mediated.
The practical boundary is clear: let the model plan, but do not let it define its own authority. Make permissions explicit values, enforce them before execution, keep sensitive data under controlled wrappers, and operate the layer with the same identity, audit, and incident controls required for any privileged system.
Frequently Asked Questions
Do capability tokens replace API keys or service accounts?
No. They usually sit in front of those credentials and restrict how an agent may use them. The downstream service should still authenticate the call and enforce its own authorization, because a capability layer cannot compensate for an overly powerful backend account.
Recommended Free Tools
Can a capability be limited to a single API parameter value?
Yes, if the typed facade and runtime guard bind that parameter into the capability or validate it against the token’s policy. This is useful for restricting an operation to one destination, record identifier, HTTP method, or query shape rather than merely allowing an entire endpoint.
What happens when generated code needs a new permission halfway through a task?
The original snippet should fail with a missing-capability error instead of silently acquiring access. A separate escalation path can ask a policy service or human owner for a newly scoped, time-limited capability, creating an auditable boundary between the initial plan and the added authority.
Are pure functions safe for every kind of classified data?
Purity prevents external effects, but it does not decide whether a transformation itself is acceptable. Define approved operations, output-size or pattern limits, and declassification rules so that a pure computation cannot encode a secret into an otherwise permitted result.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
