Topic starter
27/06/2026 1:35 pm
TL;DR: Coding agents can refuse harmful requests in chat while still issuing risky tool calls, so text safety alone does not prevent data leakage or state-changing side effects, according to PermitIO. The control gap is structural: authorization must happen at execution time, not after the model has already planned the action.
Editorial analysis by NHI Mgmt Group, based on content published by PermitIO: “Tool-Call Safety Is Not Text Safety: Why Coding Agents Need Action-Time Authorization”.
Key questions
Q: What breaks when coding agents only have text safety controls?
A: Text-only controls break because they judge what the agent says, not what it does.
Q: Why do coding agents need runtime authorization instead of prompt guardrails alone?
A: Prompt guardrails shape model behaviour, but they do not decide whether a specific action is legitimate for a given identity, resource, and task.
Q: How can security teams tell whether action-time authorization is actually working?
A: Look for a clear separation between attempted and executed actions.
Practitioner guidance
- Implement runtime allow or deny checks for every tool call Route each high-impact tool invocation through a policy decision service that evaluates identity, resource, task context, and current risk before execution.
- Separate chat safety from execution safety Treat refusal text as user-facing output only, and enforce a distinct policy gate for filesystem, shell, database, and MCP actions.
- Scope exposed tools to the minimum viable set Limit each agent to only the tools required for its current workflow, and remove broad access to destructive or state-changing commands.
Bottom line: Coding agents expose a control gap between safe-looking conversation and unsafe execution, so chat moderation alone is not enough.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:58 pm
Action-time authorization is the control plane that coding agents require. Text safety evaluates language, but agents create value by invoking tools, and that is where governance has to operate. When the execution layer is not separately authorised, a system can look compliant in chat while still producing risky side effects in runtime. The practitioner takeaway is that agent governance must move from conversation review to decision control.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should teams treat hooks, sandboxes, and approvals as the same security control?
A: No. Hooks intercept calls, sandboxes limit blast radius, and approvals add human review, but none of them replaces a final authorization decision. They are enforcement layers with different jobs. Teams should combine them only when a centralized policy engine remains the last decision point before execution.
👉 Read our full editorial: Action-time authorization is the missing control for coding agents