The Rule of Two

The more permissions you give agents, the more you must separate them and grade them, and never give everything to every agent.

Lets try to unpack this a bit and turn it into a rule we can follow.

The three legs

1. It reads content written by others
2. It holds a key, a password or a logged-in account
3. It can send, publish, write outside the workspace or delete

Any two are manageable. All three in one agent means a single poisoned email is enough: the instruction arrives through the first leg, uses the access in the second and leaves through the third. Security researchers call the full set the lethal trifecta. Meta's security team named a framework for avoiding it the Rule of Two; this course's version is adapted for a solo builder, and it comes down to the habit of never assembling the set.

The usual suspect

The agent that holds all three is rarely the one you worry about. It is the convenient routine: the nightly job that reads the inbox, uses your Gmail login and sends replies while you sleep. Nobody designed it to be dangerous. It grew one useful permission at a time.

Two ways to break the set

• Split it. A reader that only turns what it read into a short structured list (who, what, when), and an actor that works from that list and never sees the raw text. Most of it stops at the reader, because the actor never reads the raw text. Keep the fields the reader hands over short, so little can ride through.]
• Stand in front of the send. Keep one agent, and make every outbound action wait for your yes. It is slower, and at the scale of one person it is often the right trade

The same thinking answers the question about access to the whole computer. Give each agent only the folders and tools its job needs. Your worst day is bounded by what an agent could reach, whatever it was told.

For every agent, routine and automation I have, fill three columns:
1. reads content written by others
2. holds an API key, password or logged-in account
3. can send, publish, write outside the workspace or delete

Flag every row with three yes.

For each flagged row, propose either a split into a reader that only summarizes and an actor that never sees the raw text, or a step where I approve before the outbound action.