AI Agent permissions belong in infrastructure and not in prompt.

I built and evaluated the workflows for one of our customer support agents, which handles over 200 cases a week.

Most of the work was deciding which case types the agent may close by executing a static script and when to hand off to a support team, e.g., when the shape of the request is bad.

In a test I ran I found the agent would let a user change someone else's details. No infrastructure boundary.

Now every cross-account action, meaning any change to an account other than the requester's own, checks the requester's role and permissions first. A user can change their own account but nobody else's.

Tanya Janca (@shehackspurple) on X, Oct 8, 2026: "A prompt is NOT a security boundary."

Michael Albada, Building Applications with AI Agents, O'Reilly Media, 2025. Chapter 12, Protecting Agentic Systems (O'Reilly Learning)