“You wouldn’t hand a new hire the master key on their first day.”

You wouldn't hand a new hire the master key on their first day. So why do so many businesses hand an AI agent full access the moment they wire it up?

A fence, not a feature

Anthropic shipped something small this month that I think matters more than the headline features. Claude Code, the tool I use every single day, added a --restricted flag. Turn it on and the agent loses the ability to run arbitrary commands or fetch from the open web, its file access stays locked to the one project folder you pointed it at, and it can't bypass your permission settings even if it's told to.

That's not a flashy feature. It's a fence.

Where the horror stories actually come from

Here's the thing: most of the AI horror stories I read (and I read a lot of them) don't come from the model being malicious. They come from an agent being handed more reach than the task needed, and then doing exactly what it was capable of doing, which was more than anyone intended.

The question I ask first

When I set up an automation for a client, the first question I ask isn't “what can this agent do.” It's “what's the smallest set of permissions this agent needs to do its actual job.” Full access is easy to grant and hard to take back once something's connected to your real systems, your real inbox, your real books.

A restricted mode built into the tool is a good default. But you don't need to wait for the vendor to build it. Scope the access yourself, every time, before you scope the task.

If you want a second set of eyes on what your own AI tools actually have access to right now, that's exactly the kind of conversation worth having. Find me through the contact section of this site.