X'inhu r-riskji tal-mogħa ta' permess lil agentit tal-AI biex jaqbeż, u kif tillimitiha b'mod sigur?

Question

Accepted Answer

Meta agentit jista' **jaqbeż** — ħassar files, jaħdem kmandi shell, iċċallja APIs esterni, jinfeq flus — l-iżbalji tiegħu (jew prompts malizzjużi) issiru konsegwenzi fil-ħajja reali. Id-difiża hija **least privilege flimkien ma' approval gates flimkien ma' isolation**: agħtiha biss dak li għandu bżonn, iddamand konfermazzjoni għal xi ħaġa li ma tista' tiġi rriversa, u ħalliq fejn ma jistax jagħmel ħsara waħda.

## Ir-riskji

```text
- DESTRUCTIVE actions  → rm -rf, DROP TABLE, force-push → irreversible data loss
- ARBITRARY shell      → run anything → privilege escalation, exfiltration
- EXTERNAL APIs/$$     → send emails, place orders, spend on cloud/LLM tokens
- SECRET exposure      → leak API keys / .env / tokens into logs or outbound calls
- PROMPT INJECTION     → untrusted input (a web page, an issue) hijacks the agent
```

Prompt injection huwa l-aktar ħafifa: il-kontenut li l-agentit *jaqra* jista' jkun fih istruzzjonijiet, b'hekk kwalunkwe tool li l-agentit jista' iċċallja jista' jkun miksub minn attakkant li jikkontrolla dak il-kontenut.

## Safeguards

```text
- LEAST PRIVILEGE / ALLOWLIST → only pre-approved commands & paths; deny by default
- APPROVAL FOR DESTRUCTIVE    → human confirms deletes, payments, prod writes
- SANDBOX / DRY-RUN           → preview the action; isolated container, no prod creds
- ISOLATED ENVIRONMENT        → ephemeral VM/branch; blast radius = throwaway box
- AUDIT LOGS                  → record every tool call + args for review
- NO SECRETS IN CONTEXT       → inject via env at runtime; never paste keys into prompts
- NETWORK LIMITS              → egress allowlist; block arbitrary outbound requests
```

```yaml
# Conceptual permission policy
tools:
  read_file:   { allow: true }                 # safe, reversible
  run_shell:   { allow: ["npm test", "git status"] }  # allowlist only
  delete_file: { allow: "ask" }                # human approval required
  send_email:  { allow: "ask", sandbox: true } # dry-run first, then confirm
network:
  egress: ["api.github.com"]                    # everything else blocked
```

Il-patern huwa graduated trust: **qari** huwa ħielsa, **reversible writes** għinwar, **azioni irreversible jew esterni** jeħtieġu konfermazzjoni, u **flus jew produzzjoni** jeħtieġu isolation flimkien ma' bniedem fil-loop.

## Għaliex hija importanti

Il-valur tal-agents jiġi mill-mogħa li tindgħahom jaqbżu, iżda l-azzjoni hija eżatt fejn żball kunfidenti jew prompt iksaħ jissibuq f'dejta mħassra, ċavetta exposed, jew kariga vera. Id-disinn tal-permessi bħala least-privilege allowlists, il-gating tal-azioni irreversible wara l-approvazzjoni tal-bniedem, ir-run f'sandboxes b'audit logs, u l-keep tal-sekreti u n-network egress strettament scoped jillowk tikseb il-leverage tal-autonomija mingħajr ma tħutt il-produzzjoni f'riskju li l-mudell ikun tajjeb kull ħin.