Most mistakes in agent permissions come from five assumptions: that prompts are permissions, that read access is safe, that approval prompts are a boundary, that internal agents need less control, and that review once is enough. Each is partly true and each fails in a predictable way.
Myth 1: A prompt rule is a permission
Fact: it is a request to the model. OWASP's complete mediation principle says authorization belongs in downstream systems, not in the model's judgment. Injected text can override a prompt, and it cannot override a failed server side check.
Myth 2: Read only access is safe
Fact: it limits changes, not exposure. A read tool can return sensitive records to a model, which can pass them to a send tool. Scope read access to the data the task needs and watch what leaves.
Myth 3: An approval prompt is a security boundary
Fact: it is a human check, and humans tire. The MCP specification says there should be a human in the loop with the ability to deny invocations and that clients should present confirmation prompts. It does not claim prompts replace server side controls, and it separately requires servers to implement access controls. Keep prompts for high impact calls so that approvers still read them.
Myth 4: Internal agents need less control
Fact: internal agents often hold broader credentials than external ones, since they run inside the trust boundary. OWASP lists excessive permissions as a root cause on its own. An agent that reads untrusted text, such as inbound email or web pages, can be steered whether it is internal or not.
Myth 5: Reviewing permissions once is enough
Fact: agents change. Servers can announce new tools through a list changed notification, prompts get edited and owners leave. A grant that was right at launch becomes drift. Schedule a review and compare live tools with the approved list.
Summary table
| Myth | What to do instead |
|---|---|
| Prompts are permissions | Enforce in code at the tool, proxy and downstream |
| Read is safe | Scope the data, log reads, limit outbound tools |
| Approval is the boundary | Use it for high impact calls with clear context |
| Internal means trusted | Give every agent its own narrow identity |
| Review once | Review on a calendar and on every tool change |
How to use this list
Pick the myth your team believes most and test it this week. For example, ask an agent to call a tool outside its list and see where the call stops. The place it stops, or fails to, tells you where your real control is.
Safeguard offers MCP Guardrail and agent identity for applying this kind of policy to agent tool calls, and you can run a free scan of your own repositories at gold.safeguard.sh/scan. Autonomous fix pull requests are off by default, and every category starts on Manual.
Quick check
Which myth causes the most damage?
Treating prompt rules as permissions, because it leaves no enforced boundary at all.
Do approval prompts still matter?
Yes, for high impact calls. Just do not treat them as the only control.
Sources
Last reviewed: 19 October 2026.
