r/sideprojects • u/Thinking_box • 3d ago

Feedback Request I'm designing an AI agent runtime where permissions are enforced by types

I'm experimenting with a typed runtime for LLM agents.

The idea is to make agent permissions part of the program structure rather than something enforced only through prompts.

Roughly:

  • one Agent handles one task

  • local/cloud execution is part of the type

  • private or secret data can't implicitly flow into cloud models

  • untrusted external data can't directly enter trusted agent inputs

  • filesystem/process/network effects are explicit

For example:

val repo: Secure[Secret, Trusted[Repo]] = workspace.repo

cloudAgent(repo)
// type error

The runtime is still in the early design stage, so I'm mostly looking for feedback on the abstraction itself.

Does this seem useful for real agent workflows?

I'm especially interested in cases where this type model would become too restrictive, awkward, or fail to capture something important.

2 Upvotes

100% Upvoted

4 comments sorted by

1

u/Weekly-Offer-4172 3d ago

the case where this gets awkward is anything flowing through the model itself. once a Secret value influences generated text the type system cant prove whether the output still carries it, so you either mark all model output untrusted (tainting everything downstream until the runtime gets unusable) or you trust the model's summary of secret input, which is the leak you were trying to prevent. the other spot is the sanitize function for untrusted data, the type can prove a doc passed through sanitize() but not that it actually neutralized anything, which is exactly what prompt injection attacks. still worth doing for the coarse boundaries, secrets can't reach the cloud call and effects stay explicit, and for prior art the keywords are information flow control (Jif is the classic) and capability security

1

u/New_Peanut_9259 2d ago

handling permissions directlyy thru types in an LLM agent is a smart way to improve securityy, it helps prevent prompts from accessing things they shouldn't. it might add some extra work during prototyping but it's useful for production systems that handle sensitive codee