Как избежать over-permissioned agents в production: least privilege, sandboxing, confirmation gates?

Over-permissioned agent = blast radius равен сумме всех его tools/scopes; jailbreak → admin-уровень компрометация. Защита: (1) capability-based access — short-lived signed tokens с узким scope (15-30 min TTL), issued per-task; (2) role-based agents — reader_agent без write tools, editor_agent без delete, admin_agent всегда с HITL; (3) sandboxing — Firecracker microVMs / gVisor / Lambda; (4) confirmation gates для destructive (delete, deploy, transfer); (5) blast radius limits — rate caps (10 deletes/hour), idempotency, audit. Принцип: «default deny, explicit allow».