How an AI agent is kept inside its permissions, and why it can't forge the record
An AI agent acts with the intersection of its own declared scope and the user's permissions — never more than both allow — recomputed as the work runs, so access lost mid-session is access gone. Each handler runs in a sandbox that can only call what its interface grants, and every model and search call is written to an immutable log stamped with the caller's identity by the host. The logging interface has no field for identity, so a compromised handler has nothing to forge. This is greenfield-wasm, the runtime Greenfield Production Systems uses for regulated work.
Updated
If you are putting AI agents anywhere near production, two questions arrive together: what stops an agent from doing something it shouldn’t, and how would you ever prove what it did? The weak answer to both is a policy document and a hope that the model behaves. The stronger answer is to make the dangerous things structurally impossible and the record impossible to forge, so neither depends on the agent cooperating. That is what greenfield-wasm is built to do.
Least privilege an agent can’t widen
An agent does not run with a user’s full permissions, and it does not run with its own declared permissions either. It runs with the intersection of the two — only what both the agent and the acting user are independently allowed to do. A broadly capable agent invoked by a limited user is bound to the user’s limits; a powerful user working through a narrowly scoped agent is bound to the agent’s. Neither side can be used to escalate the other. The effective set is recomputed as the work proceeds rather than frozen at the start, so access taken away in the middle of a task is gone immediately, not at the next login.
A record the code can’t forge
The reason an agent cannot rewrite its own history is that it was never handed the pen. Every external call is written to an immutable, append-only log, and the identity on each entry is stamped by the host from a trusted envelope the handler cannot see or modify. The logging interface a handler uses has no field for identity at all — so a compromised handler has nothing to pass in, and nothing to forge. The trail records who acted, not who the code claimed to be. This is the same idea the factory applies to a build: the property holds because of how the system is constructed, not because someone remembered to check.
A sandbox that limits the blast radius
Each handler runs in a WebAssembly sandbox with explicit resource limits and capability-scoped access. It can call only what its interface grants — a read-only handler has no write path, a handler with no network grant cannot reach the network — and those boundaries are enforced at the interface, not as a runtime permission check a clever input might evade. Outbound calls that are allowed pass through a host allowlist that blocks private-network addresses, which shuts the door on the server-side request forgery a prompt injection would otherwise use to reach your internal systems.
Evidence an auditor can check without us
Controls only matter if someone skeptical can verify them. A compliance pack from greenfield-wasm is cryptographically signed, so an auditor can verify it offline, with no access to our infrastructure, and the recorded history can be replayed for review. As with everything we ship, we state plainly what is covered for your specific deployment before it touches anything you rely on. The platform page lays out what greenfield-wasm is and who it is for, and a short call settles what the guarantees mean for your situation.
Questions this answers
- How do you stop an AI agent from doing more than it's allowed?
- An agent acts with the intersection of two permission sets: what the agent is declared to do, and what the acting user is allowed to do. It can never exceed either, so a broadly scoped agent is still bounded by the user on whose behalf it runs, and a powerful user is still bounded by the narrow agent they invoked. That effective set is recomputed as the work runs rather than fixed at the start, so permission revoked mid-session is permission gone, not a window that stays open until the task ends.
- Can an AI agent forge or alter its own audit log?
- No, and the reason is structural rather than a rule we ask handlers to follow. Every external call an agent makes — every model prompt, every search — is written to an immutable, append-only log, and the caller's identity on each entry is stamped by the host from a trusted envelope. The interface a handler uses to log has no field for identity in the first place, so there is nothing for a compromised or prompt-injected handler to pass in and forge. The trail records who acted, not who the code claimed to be.
- What stops a compromised handler from reaching internal systems or exfiltrating data?
- Each handler runs in a WebAssembly sandbox and can only call what its interface explicitly grants it, so a read-only path has no way to write and a handler with no network grant has no way to call out. Where outbound calls are allowed, they go through a host allowlist that blocks private-network addresses, which closes the usual server-side request forgery route a prompt injection would try. The limits are enforced at the interface boundary, not as a runtime check the handler might slip past.
- How would an auditor actually verify any of this?
- The evidence is built to leave the building. A compliance pack is cryptographically signed, so a reviewer can verify it offline without any access to our systems, and the recorded history can be replayed for review. We still state plainly what is covered for your specific deployment before it touches anything you depend on, rather than handing over a guarantee you have to take on faith.
- Is this the same platform you build everything on?
- Not quite. Standard engagements run on greenfield-ts, our production TypeScript platform. greenfield-wasm is the compliance-grade runtime, built for work where you have to prove not just what the software does but who did what and when — financial services, government, healthcare. Both are production-grade; greenfield-wasm carries the heavier guarantees, sandboxing and an immutable audit trail, because the regulated work it is for cannot tolerate less.