Skip to lesson
Exit
AI & Agent Security Threat Model1 / 2

2 min lesson

Capability-based design

Respond to "Why does a default-deny capability, scoped to the task in front of the agent, beat a denylist of dangerous commands?" Name the reason and the detail behind it.

Step 1 of 2

Capability-based designgrant what the current task needs, nothing standing

The same least-privilege and just-in-time thinking you'd apply to cloud IAM applies inside the agent. The agent shouldn't hold a standing grant to every tool for the whole session. It should hold a capability scoped to the task in front of it and that capability should expire.

THE JIT CAPABILITY LIFECYCLE

Interactive diagram. Step through it with the Next and Previous controls below, or Tab to a region to read its detail.

diagram: flow

Default-deny in, expire on the way out; every irreversible action escalates to a human.

Learn more

Full explanation

Capability scoped to one task

Capability scoped to one task: read-only, workspace-bound, no network, expiring.ts
type Capability = {
  tools: Set<string>;       // exact tools allowed this task
  fsMode: "read" | "write"; // write requires a gate per call
  workspaceRoot: string;    // all paths must canonicalize under this
  networkEgress: false;     // explicit; summarize/read tasks get none
  expiresAt: number;        // JIT: capability dies with the task
};
Interview move

When asked to design agent guardrails, reach for the language of capabilities and least privilege rather than a list of forbidden commands. It composes with the JIT cloud-access model the same team owns, so the two answers reinforce each other.