Personal-agent permissions need both requester identity and limits on returned data

Open Instinct, a personal-agent app, received a critique highlighting that a tool allowlist alone cannot prevent the confused-deputy problem. Even if an agent is permitted to call a tool, it might still return more information than the requester is authorized to view. The developers, who built Open Instinct and its VM provider Maritime, noted that their current implementation exposes trust tiers and tool policies in the source code, making defaults reviewable but not universally appropriate.

This report highlights that unlike a tool allowlist, a robust permission system for personal agents must also limit the data returned to prevent the confused-deputy problem.