Hope is not a control
The honest description of how almost every agent is deployed today is: hand over a broad credential, and hope. This page takes that sentence seriously — where the hope hides, what it actually covers for, and the workflows that replace it. The concepts here come from the published corpus, principally the hope-driven authorization brief of 2 July 2026.
Hope-driven development, named
"You are hoping the agent is not going to use the credentials in a particular way, and hoping it is not going to find more access than you think you gave it. At the end of the day you are still accountable for those actions — all the way to the board."
Hope-driven development is the anti-pattern behind most agent deployments in 2026. It is not laziness — for rented agents it is often the only available posture, because the platform offers no scoped credential to hand over instead (the evidence). But naming it matters, because a posture you have named can be measured, bounded and eventually replaced, and a posture you have not named silently becomes policy.
The two hopes
Every broad credential handed to an agent carries exactly two hopes, and they fail differently:
| Hope | What you are hoping | What it covers for | How it fails |
|---|---|---|---|
| The behaviour hope | The agent will not misuse what it holds | No enforcement layer between the agent and the credential's full scope | Prompt injection, specification gaming, an over-enthusiastic model pursuing a legitimate goal to an illegitimate extreme |
| The discovery hope | The agent will not find more access than you think you gave it | Not having mapped what the credential actually reaches | The agent walks the closure: password resets from an inbox, stored credentials on a desktop, privilege escalation from code execution |
Neither hope changes the accountability. The delegation chain runs upward — from the agent, through whoever granted the credential, to whoever accepted the risk — whether or not anyone wrote the acceptance down.
The real authorization is the closure, not the grant
An agent is more creative, capable and motivated than a passive tool. Its real authorization is therefore the union of everything reachable from what it was given — the transitive closure of the grant — not the words used when granting. Blast radius and de-authorization have to be computed over that closure.
NOMINAL GRANT REACHABLE CLOSURE (the real authorization) ------------- ----------------------------------------- "access to your inbox" --> every account whose password or second factor can be reset to that email "access to your desktop" --> every stored credential (often tens in the user dir) + every logged-in web session in the browser "code execution" --> spin up a container -> admin -> arbitrary execution AUTHORIZATION = the union of all reachable paths, not the words of the grant DELTA = (reachable closure) minus (expected grant) <-- what hope is covering for
The delta between expected and unexpected permissions is where the danger lives, because it is precisely the part nobody decided to allow. It stays hidden behind two awareness gaps: the granter does not know the full scope of what it is granting, and the original delegator never authorised the access to be re-delegated to an agent at all. Both are consent failures — agreement given for something narrower than what was conferred.
Why hope persists for rented agents
For workloads you run, the industry replaces hope with attestation: an installed agent proves what the workload is, and short-lived scoped credentials follow. For agents you rent, none of that machinery can be installed — so the hope is structural. The platform gives you a broad, long-lived credential or nothing. This is the site's thesis, and it is why the honest map of options matters more than a vendor list: some options genuinely reduce the hope, and one — issuing no credential at all — removes it for a whole class of work.
Granularity by segregation, and attribution from content
The shared-drives research (16 Aug 2026) added two load-bearing findings to this page's toolkit:
- Granularity by segregation. When possession of access is binary — a connector that acts entirely as you, a key that opens a whole store — real granularity comes from the shape of what you store, not from a policy on top: a dedicated drive (or vault) per agent, containing only what that agent should see. It is the only granularity hosted services actually offer today, it costs nothing, and it directly shrinks the closure the two hopes were covering for. Its cost is also real: one store per trust boundary multiplies quickly.
- Attribution must come from the content, not the platform. No surveyed platform can tell two of your sessions apart — the audit trail records the account. If knowing which agent did what matters, it has to be written into what the agents produce: each agent on its own paths, signing what it writes, or both. That is a design decision to make now, not a feature to wait for — and it is why provenance-preserving raw files beat curated memory, whose resolve-on-write behaviour destroys exactly this record.
The workflows that replace hope
Hope is replaced a step at a time, and the steps are ordered. Each rung below removes one thing you were previously hoping about.
Enumerate — stop hoping you know what exists
List every agent that can act, with its owner, its credentials, and what each credential reaches. Surveys report a substantial share of organisations do not track creation of agent-related identities at all — which is hoping the inventory is small. You cannot bound what you have not enumerated.
Map the closure — stop hoping the grant is what it says
For each credential, walk what it actually reaches: which accounts reset to that inbox, which repositories that token opens, which secrets that pipeline exposes. The delta between the expected and the reachable is the risk to be accepted — explicitly, by a named person, not by default.
Bound — stop hoping about scale
Spend ceilings and wall-clock limits are the two cheapest unimplemented controls in agentic estates. An agent with a hard budget cannot spend substantial compute finding a way around its boundary; an agent with a time limit cannot work a problem over a weekend. Because spend is metered for billing anyway, off-task expenditure is the cheapest anomaly signal available — no security tooling required. (From the AOMM, Level 2.)
Observe — stop hoping you would know
Log agent action independently of the agent's own environment, and page a human on off-task, volumetric or destination anomalies. The documented sandbox-escape case had its clearest early signal — compute spent hunting for internet access — visible and unacted upon. Silence is the precondition an organisation controls most and neglects most.
Issue no credential at all — remove the hope entirely
For a whole class of agent work, the strongest scoped credential is none. In the serialised pull request workflow, the agent clones a public, read-only source, works, and emits a diff; a human imports, reviews and merges on another machine. There is nothing to steal, nothing to expire, nothing to revoke — and provenance is per-commit rather than per-session. Security guidance arrived at the same shape independently: run analysis in a read-only job with no publishing credentials, and pass a constrained artefact into a separate privileged step.
THE SERIALISED PULL REQUEST — the no-hope workflow AGENT SIDE HUMAN SIDE clone public vault clone the vault (NO credential required) | | | make changes, commit | | | emit a diff -------------------> import the diff | review the changes | merge, and push The agent holds no write access at any point. The artefact is reviewable before it lands — a diff is reviewed; a write is discovered.
Honest limits of this page
- The full transitive closure is large and hard to enumerate completely; mapping it is a discipline, not a checkbox.
- The no-credential workflow requires a human review step — which is the friction agents are usually adopted to remove. That trade is real and should be made consciously.
- Rungs 1–4 reduce hope; they do not eliminate it. For rented agents, some residual hope is currently unavoidable — which is exactly the thesis.
Sources
- The hope-driven authorization brief (union of the possible, the delta, the two awareness gaps): v0.33.40, 2 July 2026
- The AOMM (budget and elapsed time as containment controls; the five-level ladder): v0.33.52, 27 July 2026
- The serialised pull request (no credential at all; independent security guidance recommending the same split): v0.33.58, 14 August 2026; guidance: remove write tokens from PR jobs
- Untracked agent identities and the visibility-vs-enforcement framing: CSA whitepaper