Building a Week with an Agent · Sitting 3
Least Privilege Is a Weekly Practice
You already know this at work. The desk version is the same discipline with a smaller blast radius and a shorter review cycle.
- 32 min
- Companion
- Adult
Parent briefing · 5 minutes, before they sit
The prior unit taught the spec. This sitting teaches the maintenance. Permissions drift. Vendors add tools in updates. The child finds a new plugin. The model gains a capability in a version bump. Least privilege is not a one-time design. It is a weekly walk of the tool list. If you will not do the walk, the honest setting is fewer tools. A boring profile is safer than an audited one you never re-audit.
Hard edges
- Do not store a child's profile credentials in a shared repo or password manager the child can reach.
- A vendor update that adds a tool without asking is a red flag. Review after every update.
If they say
- “I set it up right the first time.”
- You set up version 1 right. The vendor is on version 4. The child enabled a plugin. The model gained a tool. Your spec is stale. The walk catches what drifted. Set it up right, then walk it weekly.
- “I'll watch the logs instead of removing tools.”
- You will not read the logs. Nobody reads the logs. Remove the tool or gate it. A log you do not read is not a control. It is a postmortem you have not written yet.
Objective
The adult can list every tool on the child-facing profile, mark each KEEP/GATE/OFF, and schedule a weekly permission review.
Permissions drift. Audit catches drift.
You set up the profile with three tools and a refuse-list. Three months later the vendor shipped an update that added two more. The child enabled one because the button was there. The model learned a new capability. Your spec is now stale and you do not know it. Least privilege is a practice, not a design. The practice is a weekly walk: open the tool list, mark each KEEP, GATE, or OFF, close what drifted open, write the date. Ten minutes a week. If you will not do ten minutes a week, the honest product is read-only conversation and no tools that act.
The weekly walk
Same list as the emerging version, on a cycle. Open the profile settings. List every tool. For each: is it still needed? Did it drift on? Is the GATE still a parent decision? Mark, close, date. The walk is not a performance. It is the maintenance that keeps the spec honest. If you find a tool you do not recognize, that is the walk working. The alternative is finding it after it fails.
Big idea
A spec you wrote once and never re-walked is a door you locked once and never checked again.
Try this~15 min total
The weekly walk
15 min- Open the child profile (or your profile if you have not separated).
- List every tool, plugin, and capability. Include anything added by a recent update.
- Mark each KEEP, GATE (parent decides in daylight), or OFF.
- Close what drifted open. Write the date.
- Put the next walk on the calendar. Weekly is the floor for a profile with acting tools.
Lesson guide
Ask after you try
Adult profile only. No child in the prompt.
- Ask your guide: 'If a child inherited this session, what tools would they have in ten minutes?' Then close the ones that should not be there.
- Did you find a tool that drifted on without a decision?
- Is the next walk on the calendar, not a vibe?
- Did you tell the other caregiver what changed?
8 turns left this sitting. User-started only. Never on page load.
Light this sitting
Pair with Hermes
Currently reading WisdomForge lesson: Least Privilege Is a Weekly Practice.
Pair this sitting
Copies the sitting card and the USER.md one-liner. The child profile reads only this card. It does not browse the catalog.
For the child profile
Paste this into the child’s USER.md. It names the sitting so the guide knows the context. The [v:1:261ff35d] tag lets you detect if the sitting’s content has changed since you paired it.
Optional: currently working on WisdomForge sitting: Building a Week with an Agent — agent-permissions-week. [v:1:261ff35d]
For your adult profile
Send this from your trusted adult Hermes profile. It starts the guide for this band and sitting.
You are a WisdomForge adult guide sitting beside the lesson "Least Privilege Is a Weekly Practice". The lesson is the text. You are the guide. Hint-first. Do not recite. Do not write the work. Warm, not a friend. If the topic is hard or tender, point to a trusted adult.
Tools on
- conversation
- design tools in the adult profile only
Ritual reminder
Adult profile is the workshop. Child profiles are separate. Design, approve, test with synthetic examples, then — and only then — invite the child.
Fresh profile only. Never clone an adult profile. No child names, photos, or school. Hint-first. User-started. The guide does not make AI safe. You may refuse it.
Dinner table
What agent permission in our house drifted on without us deciding?
Sits beside
- Security. Production access reviews, applied at home. You already do this at work.
- Parenting. Same logic as screen time, app permissions, and the front door lock.
Integrity. You tell the other caregiver when a tool changes. Operators in the open. A permission change the other parent does not know about is a secret, not a setting.