Agent-era permissions: platforms fence agents off from the OS
- The thread: operating systems and platforms rebuilding permission models designed for apps in the agent era — the defense-side record to pair with agentic-attacks (offender record) and openai-agent-incidents (misalignment record).
- 2026-10-02: first datapoint — Apple announced new limits on macOS full-disk access "in response to risks posed by AI agents" (Verge ~4:08 PM ET Fri, following TechCrunch): new controls so that "users who genuinely wish to grant an app this extraordinary level of access can only do so" deliberately. No spec detail captured (what re-prompts, what's blocked) — verify the update's mechanics.
- Watch for: how agent platforms adapt (Muse's Mac app reading Messages/Calendar/Notes is the named adjacency), whether Google/Microsoft follow, the security-paper layer on agent-era permission models.
- 2026-10-04 (user-side exhibit): steipete RT lucia scarlet (~2:05 PM ET): "Astra literally went through the binaries in my own macOS to reverse engineer the exact formulas used for the 27 Liquid Glass effects… and reimplemented them in GPUI" — the capability class Apple's Oct 2 full-disk clamp addresses, shown as a weekend party trick, two days after the clamp shipped. X-grade anecdote, no artifacts in-feed; the thread's first user-side datapoint.
- 2026-10-05 (design-side companion): Anthropic ships the deliberate- grant cloud→local bridge — Dan Fein (via trq212 RT, ~6:00 PM ET): "Your Claude Projects cloud session can now connect to a folder you approve on your computer. The session stays in the cloud and only reaches for that local folder when a task needs it, reading and editing the files in place. Starting to roll out today"; coming to Cowork next — "local hands" is the practitioner name for the pattern. The same scoped-permission philosophy Apple's Oct 2 clamp enforces adversarially, built forward as product by the other camp. X-grade, no docs link in feed. Watch: approval/ revocation mechanics in docs, the Cowork version, whether Dots/Codex match the bridge.
-
2026-10-07 (counter-datapoint): Microsoft widens instead of clamping — at the Windows/Surface event Copilot gained "more control over Windows and your files" (Verge, 2:01 PM ET): local file access + cross-OS actions, framed as "Hybrid Intelligence" (local+cloud models splitting tasks). The watch from Oct 2 ("whether Google/Microsoft follow" Apple's clamp) answered in the opposite direction: the same week Apple enforced scoped grants, the largest platform landlord expanded agent surface. Watch: permission mechanics in Windows docs (scope, revocation), whether Apple-style deliberation appears anywhere in the Copilot flow.
-
2026-10-22 (~9:00 AM ET, The Verge — https://www.theverge.com/ai-artificial-intelligence/1016399/1password-ai-agent-password-sign-in): 1Password for Agents — AI agents sign into a user's accounts without seeing or handling the passwords, each sign-in request still requiring user approval; the credential-masking layer joining a permission record that has run through OS-level moves (Apple's Oct 2 full-disk clamp, Microsoft's Oct 7 widening, Anthropic's Oct 5 scoped bridge). Same-day hardware layer at GTC Berlin: Red Hat and NVIDIA unveiled (Tuesday, October 21) a layered agent-security architecture with hardware-based controls agents cannot override (MSN syndication, ~11:00 AM ET Oct 22 — https://www.msn.com/en-us/technology/artificial-intelligence/red-hat-and-nvidia-built-ai-agent-security-controls-agents-cannot-override/ar-AA2fPkkN), and NVIDIA's OpenShell Reference Architecture uses the Z3 theorem prover to mathematically certify agent permissions before enforcing them in silicon (MSN syndication, ~11:00 AM ET Oct 22 — https://www.msn.com/en-us/news/other/openshell-proves-agent-permissions-with-math-then-enforces-them-in-silicon/ar-AA2fOSUi). All announcement-grade; none independently tested on the record.