Why the patterns look the way they do
Principles of agent consent
The ideas every pattern in this library is built to protect, and why consent for an agent is a different problem than consent for an app.
Saying yes to a machine is a truly new problem. Old permission rules assume a person is holding the tool, deciding one act at a time. A machine that acts for you breaks that: it moves on its own, in bursts, across many places, sometimes on words it merely read, and it does all this under a yes you gave once and long forgot.
These are the rules the whole pattern library stands on, not a style guide, but the reasons the patterns have the shapes they have. Every pattern here holds up one or more of them. The last two are rules we hold even though no finished pattern yet fully carries them.
Consent for software agents is a genuinely new problem. Traditional permission models assume a person is at the controls, deciding one action at a time. An agent breaks that assumption: it acts on its own, in bursts, across services, sometimes on instructions it read rather than ones the user gave, and it does so under authority the user delegated once and may have long forgotten.
These are the principles the pattern library is built on. They are not a style guide; they are the reasons the patterns take the shapes they do. Every pattern exists to uphold one or more of them, and the final two are commitments the library holds even where a pattern hasn’t yet fully caught up.
Agent consent is a genuinely novel problem in permission design. The inherited models (OAuth scopes, per-action confirmations, settings toggles) all assume a human at the controls, deciding one action at a time, with the interface as rate limiter. Delegation to an autonomous system voids each assumption in turn: actions occur in unattended bursts, across service boundaries, sometimes on instructions read rather than given, under authority conferred once and long since forgotten. A principal–agent problem, a capability model, and an adversarial-input problem stacked on one consent screen.
These twelve principles are the library’s load-bearing commitments, not a style guide but the generative constraints from which the patterns’ shapes follow. Each pattern upholds one or more; the last two remain only partially patterned, declared in full rather than deferred to a footnote.
Consent requires legibility
You can only truly say yes to a thing you can understand.
A user can only consent to what they can understand.
Assent without comprehension of the specific action is not consent.
A yes is not a click. It is understanding, and understanding is the part machines skip. “The machine wants to send a letter” is a kindof thing, not the thing itself. You never saw who gets it, or what it says. Whatever you nodded at isn’t what actually happens.
That is why Action Preview puts the real letter on the table instead of a summary, and why Scoped Grantsplits look, change, and destroy into separate keys instead of one blurry “access.” An ask you can’t read is an ask you can’t refuse either.
Consent is not a click; it is an informed decision, and information is the part interfaces usually drop. “The agent wants to send an email” is a category, not an act. The user hasn’t seen the recipient, the words, or the attachment, so whatever they approve isn’t the thing that will actually happen. Legibility means the surface shows the exact action, in the terms of the action itself, before it runs.
This is why Action Preview renders the concrete fields rather than a summary, and why Scoped Grantspells out read, write, and delete as distinct, legible powers instead of one opaque “access.” A request the user can’t read is a request they can’t meaningfully refuse.
Consent is an informed decision, and the informational component is what interfaces systematically drop. “The agent wants to send an email” names a category, while the agent executes a token. That category/token gap is where agent error concentrates, since with an agent every parameter is a model inference rather than something the confirming user typed. Approval collected over a category has no referent; it transfers assent without transferring the information assent is conditioned on.
Hence Action Preview’s verbatim parameter contract (what is shown is exactly what executes), and Scoped Grant’s decomposition of “access” into read/write/delete along stated resource scopes. Legibility is also the precondition for every other principle here: refusal, proportionality, and audit all presuppose a request the user can actually parse.
Friction proportional to consequence
Heavy doors for heavy things. Light doors for light things.
The weight of a gate should match the weight of the act.
Confirmation cost must be a monotonic function of recovery cost.
One fence for everything is worse than no fence. If every act costs one click, hands learn to click without eyes, and the one ask that mattered gets lost in the noise. Friction is a signal. A drumbeat that never changes says nothing. The gate should bend with the stakes: light for the fixable, heavy for the forever.
Irreversibility Gate lives this out. The fence grows with the fall, up to type-the-words for the truly unrecoverable. Batch Approval lets the harmless pile pass in one wave and pulls the dangerous piece out to be judged alone. The goal is never more friction. It is friction spent where it buys safety.
Uniform confirmation is worse than none: when every action costs the same click, users learn to click through everything, and the one prompt that mattered is lost in the noise. Friction is a signal, and a signal that never varies carries no information. The gate has to bend to the stakes, light for the reversible and heavy for the irreversible.
Irreversibility Gate makes this its whole thesis, scaling friction with severity up to type-to-confirm for the truly unrecoverable, while Batch Approval lets routine items clear in bulk and fences the high-stakes one out of the sweep. The point is never to add friction; it is to spend it where it buys safety.
Uniform confirmation fails on information-theoretic grounds: friction is a signal, and a zero-variance signal carries no information, so users rationally compile the interaction into motor rhythm and habituation generalizes across stakes. Vigilance is a budget; every unearned ceremony is an overdraft against the prompt that will matter. The operative variable is recoverability, not felt importance: an undoable-but-important act needs less gate than a trivial-but-permanent one.
Irreversibility Gate implements the gradient per action, up to typed confirmation, which resists motor compilation precisely because it is cognitively rather than temporally expensive. Batch Approval implements it per queue, clearing the routine mass in bulk while structurally fencing the tail item out of the sweep. Proportionality is how a consent system protects its own signal-to-noise ratio.
Declining is always safe
Saying no must never hurt.
Saying no to an agent must never feel destructive or final.
Refusal must be the cheapest path, or approval stops being a choice.
If saying no costs you (lose your work, feel like you broke something, face the scary red button) you will say yes to things you shouldn’t, just to stay out of trouble. The careful path must be the cheap one. Cancel keeps you where you were. The safe answer is the one your tired hand finds first.
Every deciding-surface here points Escape and the resting cursor at the smallest answer, and Injection Flag says it loudest: the fastest way out of the box is to notobey the stranger’s words. A careful choice that punishes the chooser is a broken design, full stop.
If refusing a request is expensive (it loses work, feels like punishment, or looks like the destructive option), users will approve things they shouldn’t, just to stay safe. The cautious path has to be the cheap one. Cancel keeps the user where they were; the safe default is the one their reflexes reach first.
Every decision surface here routes Escape and initial focus to the least-committal choice, and Injection Flag makes the point sharply: the fastest way out of the prompt is to not follow the untrusted instruction. A cautious choice that costs the user should be treated as a design bug.
When refusal carries cost (lost work, destructive framing, social friction with the tool), the decision channel acquires a bias term, and observed approvals stop being evidence of preference. Consent elicited under asymmetric exit costs is selection pressure, not choice. The cautious path must therefore be the cheap one: cancel restores the status quo ante, and the reflexive gesture lands on the least-committal option in every modality.
Concretely, every decision surface in this library routes Escape and initial focus to the safe exit, and Injection Flag is the principle at its sharpest, where the cautious default is also the correct adversarial prior. Any flow where caution costs the user is a calibration error imposed on them; treat it as a defect, not a style choice.
Authority is granted over time, not in a moment
“Always allow” is a forever-gift handed over in one tired moment.
“Always allow” is a standing delegation made in a moment of task focus.
Durable authority is decided under the conditions least suited to deciding it.
The yeses that matter most are the ones that keep working after the moment that made them. “Always allow,” pressed to make a box go away, is a decision about every future day, made at exactly the moment you were thinking about something else. So standing power needs a life of its own: a place where it can be seen, fenced, and changed with a cool head.
Consent Memory makes how-long a real, visible rung at the moment of the yes, and Authority Boundarygathers all the standing yeses onto one wall the passing boxes answer to. A gift you can’t later find is a gift you can’t govern.
The most consequential grants are the ones that keep applying after the moment that created them. “Always allow,” typed to get past a prompt, is a decision about every future instance, made under exactly the conditions least suited to weighing it. Standing authority therefore needs a life of its own: a surface where it is visible, bounded, and adjustable outside the heat of the task.
Consent Memory makes durability a legible choice at the moment of granting, and Authority Boundarygathers those standing decisions into one home the in-task prompts defer to. A grant the user can’t later find is a grant they can’t govern.
Standing grants maximize the divergence between decision context and consequence context: the choice is made under task pressure, where the salient cost is the interruption, while the effects accrue indefinitely and unobserved. The in-task prompt is thus a hyperbolic-discounting machine: the button that ends the friction forever is the one that transfers the most authority, and the grants it produces are experienced as dialog dismissals, not authorizations.
The correction is architectural: durability becomes a first-class, consequence-labeled choice at grant time (Consent Memory), and the resulting standing policy materializes on one reviewable, editable surface (Authority Boundary) that the in-flow prompts defer to. Elicit in the moment, govern outside it: the two contexts have different epistemic qualities, and the system should use each for what it is good at.
An agent can never exceed its principal
The dog’s leash is never longer than your own arm.
Delegation narrows authority; it can never amplify it.
Effective authority = agent’s grant ∩ principal’s rights: delegation only narrows.
The machine’s true reach is the overlap of two things: what you handed it, and what you yourselfmay do. It can only ever be smaller than both. The machine must never become a tunnel to something you couldn’t reach on your own. That is the old trick where a strong servant gets fooled into using its master’s keys for a stranger.
And the echo of the rule matters as much as the rule: handing off never adds power. Helpers of helpers, tools, chains of machines: each link can only hold less than the one before. This is why Progressive Scopeanswers “give me more than my human has” with a flat no, why an Authority Boundaryset to “by itself” is a lid and not a gift, and why Credential Handoff hands back a small key instead of the whole ring.
An agent’s effective authority is the intersection of what it was granted and what its human principal may actually do. It can only ever be a subset. The agent must never become a path to something the user couldn’t do themselves: the classic confused-deputy failure, where a trusted intermediary is tricked into wielding its own privileges on an attacker’s behalf.
The corollary matters as much as the rule: delegation must not amplify. Sub-agents, tools, and chained calls inherit authority and can only narrow it; a hand-off is never a privilege upgrade. This is why Progressive Scope treats a request to escalate past the principal as a hard denial, why an Authority Boundaryset to “Automatic” is a ceiling rather than a new power, and why Credential Handoff returns a task-scoped credential instead of the keys.
The invariant: effective agent authority is bounded by the intersection of the agent’s grant and the principal’s own rights, at every step of every delegation chain. Violations are Hardy’s confused deputy, a privileged intermediary exercising its authority on behalf of a less-privileged requester, and prompt injection is exactly this failure in LLM-native form: untrusted content attempting to spend the agent’s standing grants.
The corollary is attenuation-only composition: delegation must not amplify across sub-agents, tools, or chained calls, since each hop inherits at most its parent’s authority. Hence Progressive Scope’s hard denial of escalation past the principal, the Authority Boundary’s Automatic level as ceiling rather than grant, and Credential Handoff’s derived, attenuated credentials in place of root secrets. Every surface that can mint authority beyond the principal is a privilege-escalation channel wearing consent UI.
Provenance is part of the request
You can’t judge an ask without knowing whose mouth it came from.
A user can’t weigh a request without knowing where it came from.
Origin is not metadata; it is a load-bearing term of the request itself.
A machine that reads the world is reading words anyone could have written. An order hiding in a page, a letter, a scroll is not your order. Treating the two the same is how trick-words become actions. Where an ask came from is not a small detail on the side. It is part of the ask, and the asking-surface must carry it.
Injection Flagexists entirely for this: it names the source, shows the stranger’s exact words, and asks you, instead of letting a page quietly steer your machine. The where-from travels with the ask, or you are judging half of it.
An agent that reads the world is reading text anyone could have written. An instruction embedded in a web page, an email, or a document is not the user’s instruction, and treating the two the same is how prompt injection turns into action. Where a request came from is not metadata; it is part of the request, and the consent surface has to carry it.
Injection Flag exists entirely for this: it names the source, quotes the instruction verbatim, and asks, rather than letting content silently steer the agent. Provenance travels with the ask, or the user is judging half of it.
Language models process command and data through one undifferentiated token stream, so channel identity, the fact that distinguishes the principal’s instruction from an instruction merely encountered, is erased at ingestion. Prompt injection is that erasure weaponized. Since the discrimination problem is adversarial and unlikely to be solved in-model, origin must be tracked through the pipeline and restored at the interface: provenance is a term of the request, and a consent surface that omits it presents the user with an unevaluable ask.
Injection Flag is this principle as a component: source named and pointed, payload quoted verbatim (paraphrase launders the judgeable specifics), compliance subordinated to dismissal. The same discipline generalizes: every approval surface here states which authority and whose intent a request rides on, because an ask with unknown provenance deserves the adversarial prior, not the benefit of the doubt.
Consent continues after approval
The yes is a moment; the act lives on after it.
Approval is a moment; the action has a life after it.
Ex-ante consent without ex-post observability is an open control loop.
The gate stands before the act. The yes doesn’t end when the machine walks through it. And for anything done under a standing yes, there was no gate at all. If the act leaves no mark you can read, your consent rots into hope: you can’t spot the mistake, question the odd call, or pull the thing back. The loop only closes with a record, and where possible, an undo-rope.
Action Receipt is that closing mark: what the machine did, under whose yes, with an undo where the act allows. A Connection Card keeps the standing yes itself visible long after it was given. The looking-back is not paperwork; it is the other half of the yes.
Every gate happens before the act, but consent doesn’t end when the agent proceeds, and for anything done under a standing grant, there was no gate at all. If the action leaves no reviewable trace, consent quietly decays into trust-and-hope: the user can’t notice a mistake, question a borderline call, or take it back. The loop only closes with a record and, where possible, an undo.
Action Receipt is that closing surface: what the agent did, under what authority, with an undo where the action allows. A Connection Cardkeeps the standing grant itself visible long after it was made. Auditability isn’t a compliance nicety here; it is the other half of consent.
Ex-ante mechanisms end at execution, and standing grants never had an ex-ante moment at all, so without an exercise record the consent system runs open-loop: policy set, actions taken under it, no signal returning to inform whether the policy produces the intended behavior. Every governance operation (detecting error, contesting a borderline call, reversing a wrongful act, tightening an over-broad grant) takes the record as its object and is undefined without one.
Action Receipt closes the loop: effect, timestamp, and the authority under which the action ran (the differentiating field), with reversal offered exactly where it can be honored. The Connection Card keeps the grant itself observable between exercises. Auditability is the feedback path of delegation, not its paperwork; a grant whose exercise is unobservable is ungovernable by construction.
Revocation must be real and immediate
A gift you cannot take back was never a gift. It was a surrender.
A grant you can’t effectively withdraw was never really consent.
Consent is only meaningful under a credible, low-cost exit.
A yes that can’t be un-said is just a one-way door with a friendlier sign. Taking back must truly stop the power (halting what is already running, not just hiding a switch for next time), or you never really held the leash you were told you held. Being able to end a gift is what made giving it safe at all.
Connection Card keeps pause and take-back one reach from every standing connection, and an Authority Boundarylets any ability be moved to “Never”. A fence that can only widen isn’t a fence. The way out is what the whole system is built around.
Consent that can’t be taken back is just a one-way door with a friendlier label. Revocation has to actually stop authority (halting what is in flight, not merely hiding a toggle for next time), or the user never truly held the power they were told they had. The ability to end a grant is what makes granting it safe in the first place.
Connection Card keeps pause and revoke one affordance away from a standing connection, and an Authority Boundarylets any capability be moved to “Never”. A boundary that can only widen isn’t a boundary. Revocation is the exit the rest of the system is built around.
A grant without a credible exit is a transfer, not a delegation, and the credibility conditions are strict: revocation must bind enforcement (halting in-flight work, not hiding a toggle), take effect immediately, and cost little enough to be exercised under doubt rather than only under proof. Revocation-in-principle buried behind support tickets is not revocation; effective permanence is measured at the affordance, not the policy.
Connection Card keeps pause (the cheap, reversible stop that gets used where destruction hesitates) and revoke one reach from every standing connection, and the Authority Boundary’s “Never” makes prohibition expressible, not just degrees of yes. The exit is also what licenses everything else: users rationally grant more when withdrawal is credible, so revocation is the load-bearing column under the whole consent economy.
Authority should expire by default
A standing yes is not the same as a forever yes.
Standing is not the same as forever.
The default lifetime of a grant should be finite.
Yeses pile up. Each one made sense on its day, but left alone they heap into a mound of standing power no one remembers agreeing to. The cure is a built-in lifespan: gifts that lapse unless renewed, so sleeping power dies quietly on its own instead of waiting, live, for someone to trip over it.
Consent Memorymakes “just this once” and “this sitting” real rungs instead of burying everything under “always,” and Spend & Rate Limits ties standing power to a window that resets. The safe end of a gift is that it ends.
Permissions accrete. Each one was reasonable when granted, but left alone they pile up into a standing surface no one remembers agreeing to. The correction is a default lifetime: grants that lapse unless renewed, so dormant authority expires on its own instead of accumulating into risk the user has to notice and prune by hand.
Consent Memorymakes “just this once” and “this session” first-class choices rather than burying everything under “always,” and Spend & Rate Limits bounds standing authority to a window that resets. The safe default for a grant is that it ends.
Grant inventories grow monotonically under indefinite defaults: authority is added at task frequency and removed only by deliberate audit, so dormant grants (pure latent risk, still-live attack surface with no earning exercise) accumulate as the steady state. Expiry inverts the maintenance burden: a lapsing grant makes continued authority the thing that must be affirmed, aligning the default with least privilege on the time axis and pricing renewal at its true (low) cost instead of pricing revocation at its true (high, attention-bound) one.
Consent Memorymakes bounded durabilities (once, this session) first-class rungs rather than fine print under “always,” and Spend & Rate Limits gives quantitative authority a window that resets rather than a total that accrues. Where indefinite grants are truly warranted, they should be the marked case (chosen, weighted, and re-surfaced), never the silent default.
Minimize what the agent can see
The smallest key, and the smallest window too.
Least privilege applies to data, not just actions.
Observation is authority: context minimization is scope minimization.
Everyone worries about what the machine can do; what it can see is power too. A machine handed a standing window into your whole letter-pile, your whole cave, carries the danger of all of it, on every job, and through every trick played on it. Smallest-key means handing over the least the job needs to see, and never the raw secret underneath.
Scoped Grant makes how-much-it-sees a visible, choosable thing instead of all-or-nothing, and Credential Handoff keeps the machine out of the secret-passing entirely, taking back a small key instead of a password. What the machine never receives, it can never spill.
Most attention goes to what an agent can do, but what it can see is authority too. An agent handed a standing window into an entire inbox, drive, or account carries the risk of all of it, on every task and through every injection. Least privilege means handing over the least context a task needs, and never the raw secret behind it.
Scoped Grant makes the granularity of access legible and selectable instead of all-or-nothing, and Credential Handoff keeps the agent out of the credential exchange entirely, taking back a scoped token rather than a password. The data an agent never receives is the data it can never leak.
Capability gets the attention, but observation is authority of the same kind: for a language-model agent, everything seen enters a context that is logged, cached, and processed alongside adversarial input, so data exposure compounds with injection risk multiplicatively. The injected instruction can only exfiltrate what the context contains. Least privilege therefore has a data clause: minimum context the task requires, and never the root secret when a derived credential will do.
Scoped Grant makes observation scope a selectable, per-resource decision rather than an account-wide side effect, and Credential Handoff excludes the agent from the credential path structurally, returning scoped, expiring instruments instead of passwords. The bound is absolute in one direction: data the agent never receives is data no compromise of the agent can leak.
The acting agent must be identifiable
You said yes to one machine, not to whatever wears its face.
A user consents to a specific agent, not to whatever later wears its name.
Consent binds to a specific acting identity; substitution voids the binding.
A yes is given to this machine: the one whose plan you saw, whose name was on the ask. Swap the brain inside it, hide a second helper behind it, or let a stranger borrow its face, and the yes you gave no longer covers what actually acts. Whoever moves must be the one you agreed to, and their name must ride on every ask and every mark left behind.
Action Preview and Action Receiptalready carry part of this: both name the machine and the power it acts under. But the harder question, what makes tomorrow’s brain still the samemachine you trusted, has no pattern of its own here yet. It is named so the gap isn’t quietly lost.
Consent is given to a particular agent: the one whose plan the user reviewed, whose name was on the request. Impersonation, silent model swaps, and unlabeled sub-agents all defeat that: the actor’s identity is a term of the grant, not deployment metadata. Whoever acts must be who the user agreed to, and that identity has to travel with every request and every receipt.
Action Preview and Action Receiptalready carry part of this: each names the acting agent and the authority it runs under. But the deeper problem, what makes tomorrow’s model still “the same agent” the user trusted, has no dedicated pattern here yet. It is stated so the gap stays visible rather than papered over.
Consent binds to a specific acting identity; impersonation, silent model substitution, and unlabeled sub-agent delegation each void that binding. Identity is a load-bearing term of the grant rather than deployment metadata, and it must be tracked through the pipeline and restored at every request and receipt; otherwise the principal has authorized an actor they cannot name.
Action Preview and Action Receiptpartially serve this, carrying agent and authority attribution at approval and audit time. The unsolved core is identity continuity (what makes tomorrow’s model “the same agent” as today’s), which deserves a dedicated pattern this library does not yet have; it is declared here rather than deferred to a footnote.
The user can always interrupt
A rope you can pull at any moment to stop the machine mid-run.
A user must be able to stop an agent mid-run, not just between steps.
Interruptibility is a consent property: a stop that binds mid-run, not only at step boundaries.
A yes includes the right to look away, and still be safe when you look back. That only holds if you can grab the machine while it runs: pause it, call it back, take the wheel yourself, in the middle of the work, not only in the gaps between steps. A stop that lands only between steps is barely a stop for a machine that moves in one long rush.
No pattern here holds this up yet. The stop-rope (how it looks, how fast it must bite) wants a shape of its own. It is named now so the gap isn’t forgotten.
Consent includes the right to withdraw attention and remain safe, and that holds only if the user can stop the agent while it acts: pause, cancel, or take over mid-run, not merely at the boundaries between steps. For an agent that works in one long burst, a stop that only lands between steps is barely a stop; interruptibility, and the latency it promises, is part of the authority model, not a UI courtesy.
This library has no pattern for it yet. The interrupt affordance, its visibility, and its response-time guarantees deserve dedicated treatment. It is named here so the gap stays on the record rather than disappearing.
Interruptibility is a consent property: a legible stop (pause, cancel, take-over) that binds mid-run rather than only at step boundaries. Delegation includes the right to withdraw attention without forfeiting safety, which makes the interrupt affordance and its latency guarantees part of the authority model rather than interface polish. An agent that cannot be halted between commitments has, in effect, been granted more than any prompt disclosed.
No pattern in this library upholds it yet. The stop affordance (its salience, its binding semantics, its worst-case response time) deserves a dedicated pattern; the principle is declared here, unpatterned, rather than omitted.