MCP grants AI agents access to file systems, Git, cloud, and SaaS. Yet permission models — IAM, OAuth scopes, PATs — were built for humans and fall short for AI.
The issue isn’t granularity. Existing permissions assume “human rationality” as a boundary: write access doesn’t mean a human wipes a repo; CI write access doesn’t mean a human exfiltrates secrets. Permissions stay broad because human judgment fills the gap. AI lacks this buffer — through prompt injection or edge cases, it acts destructively where a human would stop. Per-call approval collapses under fatigue.
As an SRE on strong production credentials, my question wasn’t “how to restrict AI” but “how to maximize safe delegation.”
I propose Intent as Code: coding what was left to human rationality. Three OSS tools: safe-push rejects pushes touching .github/ or others’ commits, preventing CI hijacking safe-gh wraps gh CLI with conditions like “only own issues” or “only approved PRs to develop” — expressing intent PATs can’t safe-webfetch uses Claude Code Hooks to auto-allow learned-safe URLs, cutting fatigue decisions
Attendees leave understanding why permissions fall short for AI, with patterns to apply.
