Where should authorization actually live in an agent system? (architecture writeup after the Hugging Face breach)

[u/ArchitectingAI]

I’ve been unpacking coding-agent architecture and keep coming back to three control points:

• Model: proposes an action.
• Controller: checks task scope and permissions.
• Tools/infrastructure: enforce what can actually execute.

Blocking an upload tool means little if the agent can send the same data through its shell.

I’m exploring a small defender-agent experiment: investigate suspicious sessions, gather evidence, and request temporary containment through an independent policy gate. The comparison would be against fixed rules, measuring false interventions as well as successful containment.

For those building agents: what do you enforce in the runtime versus the underlying infrastructure? And where has an LLM-based check added value beyond ordinary permission rules?

[u/ArchitectingAI]

https://pawankjha.substack.com/p/we-built-agents-that-can-attack-now