Safety before agency

The wrong boundary

Safety is often placed at the edge of generation: a policy checks the user prompt or model response, then the application proceeds. That boundary is insufficient for an agent that reads untrusted material, holds credentials, invokes tools and changes a real project.

The dangerous instruction may arrive in a downloaded page rather than the user prompt. The model may produce a reasonable command with an unreasonably broad path. A permitted network request may carry more context than the user expected. A safe write may still be the wrong product decision.

Safety has to compose around action.

Before action

The project has a trust level. Tools have permission policies. Untrusted content is scanned for instruction injection and recorded as a safety signal. Secrets stay in dedicated storage and do not persist in browser state. The model receives the tools and context appropriate to the current mode, not every capability the application owns.

These controls decide what may begin. They are designed to fail visibly rather than converting an error into silent approval.

During action

The tool boundary applies file and shell constraints. Supported outbound calls are categorised and recorded. Miton’s egress completeness checks cover both desktop request surfaces: WebView globalThis.fetch and Rust reqwest. A scan of only one surface cannot support an exhaustive claim.

This evidence does not imply that every external service is trustworthy. It gives the user and the system a record of which boundary was crossed and why.

After action

Activity, diffs and run history make the consequence inspectable. Rewind and project recovery reduce the cost of a wrong approved change where the side effect is reversible. External messages, third-party writes and migrations still require particular care because restoring local files may not undo them.

Defence in depth, stated honestly

No injection detector catches every attack. No permission prompt prevents every mistake. No audit ledger can retract data already sent. Safety comes from independent layers that limit how far one failure can travel, plus an interface that helps a person understand the decision.

Miton’s position is therefore “safety before agency”, not “safe by AI”. More capability earns more explicit boundaries, better evidence and clearer recovery.