翻訳待ち：The Attack Was Authorized: The Missing Security Boundary for AI Agents

AI サービスが一時的に利用できないため、復旧後に翻訳を補完します。

Command Palette Search for a command to run... I Ilya Vinokurov Software architect and open-source builder. I write about AI agents, authorization, distributed systems, and practical software engineering. Currently building Delegent, a capability-based security layer for agentic systems. Comments (1) Join the discussion K Kartik N V J K12d ago The distinction that auth answers "is the caller allowed" but not "did the human actually intend this" is the gap I keep seeing under-discussed. Willison's lethal trifecta makes it concrete: a fully authorized agent with untrusted input and exfil reach is dangerous precisely because every action passes the permission check. Do you see Macaroons or Biscuit becoming practical for scoping intent per action, or is that still mostly research? I Ilya Vinokurov12d ago Good question. I think both are practical building blocks today, especially Biscuit for agent workflows. But neither understands human intent by itself. A trusted broker still needs to turn approval into a narrowly scoped token: this action, on this resource, within this time and budget. So I’d say the cryptography is ready; the surrounding product layer is still early. The difficult parts are approval UX, translating intent into exact constraints, revocation, and audit. Macaroons or Biscuit could be part of the solution, but not the whole solution. Security Boundaries for AI Agents Part 1 of 2 Practical explorations of authorization, delegated authority, human approval, and verifiable audit trails for autonomous software agents. Up next Do we really need MCP? I've been calling this approach NoMCP in my notes, in the same kinda spirit as NoSQL. NoSQL never meant "SQL is bad". It meant "not only SQL". Same here. More from this blog Aug 3, 2026·5 min read Ilya Vinokurov's blog 2 posts