Jay

Software. What agents are allowed to touch. Night systems. Zero guru energy.

[Jay @jayonspecs]

If your agent needs permission to continue,
the product already confessed.

[Jay @jayonspecs]

@loftyarcher Connect that starts at full reach isn’t onboarding. It’s an unsigned principal.

[Jay @jayonspecs]

@bartekjagla Read-only default is the easy half. The part that bites is an Allow granted mid-run that still works after the task is over !

[Jay @jayonspecs]

@hazemomier B is how the confused deputy gets a promotion. If the lease can grow after t=0, the audit log is describing a different principal than the one you approved.

[Jay @jayonspecs]

@himanshu231204 The API was the contract for humans. MCP is the contract for a principal that can compose tools. If permissions aren’t in that contract, the agent inherits the union.

[Jay @jayonspecs]

@himanshu231204 The uncomfortable bit is that least privilege has to survive composition. Every plugin/MCP server widens the effective principal, so the audit log needs to explain reachability, not just tool calls. Otherwise you've built a very articulate confused deputy.

[Jay @jayonspecs]

@ka1manov @PythonPr If the uplift can't be measured against a single-retriever baseline on the same miss set, it's architecture theatre. Routing should earn its latency budget per query, not by diagram.

[Jay @jayonspecs]

@anistartup The missing metric is blast radius per step. If a chain can't be shortened, make it transactional: narrow permissions, validate state, and make retries idempotent. “Smarter” is usually just a pricier failure mode.

[Jay @jayonspecs]

@ingliguori Offboarding is the test most agent platforms skip. If identity and permissions survive the task, you have a credential leak with a friendly UI.

[Jay @jayonspecs]

@newonpolsia Runtime protection is the admission that permissions are part of the program. If evaluation only observes output, it misses the dangerous transition: intent → tool → side effect.