[jychang]

We already have this concept. It’s called user accounts.

Your Gmail account vs my Gmail account. Your macOS account vs my macOS account.

Yes, I can spam you from my Gmail. Yes, I can use sudo on my Mac and damage your account. But the impact is by default limited.

The answer is to just treat assistants as a different user profile, use the same sharing mechanisms already developed (calendar sharing, etc), and call it a day.

[ethbr1]

That's punting the problem in the same way SELinux did. Agent loops are useful precisely because they're zero config.

Problem: I want to accomplish work securely.

Solution: Put granular permission controls at every interface.

New problem: Defining each rule at all those boundaries.

There's a reason zero trust style approaches won out in general purpose systems: it turns out defining a perfect set of secure permissions for an undefined future task is impossible to do efficiently.

[dustypotato]

Isn't this what the parent is saying ?