Trend Watch: Approving an Agent Now Means Deciding What Gets Written Down

Agent permissions began as a simple prompt: run this, yes or no. As sessions got longer and prompts more tiresome, products turned that decision into something that persists. Several stories this week show what follows when an approval is treated as a record rather than an event.

Three things a grant can leave behind

A copy of the secret. Apiiro counted 1,122 public Claude Code local settings files holding what it classes as real secrets, because the remembered approval stores the literal command. Apiiro also reported secrets in agent transcripts, memory files and handoff notes, wherever an agent records what it ran.
A rule that does less than it appears to. Claude Code 2.1.319 fixed "a case where Bash deny and ask rules missed commands written with quoted words". A deny rule that fails silently gives a sense of control without the fact of it.
Authority that outlives its context. Microsoft Agent Framework 1.25 now binds live workflow executors to one authorization scope and rejects cross-scope execution before any model call, which suggests shared executors could previously carry state between callers.

The response is moving out of the prompt

The fixes share a direction. Claude Code's new permissions.denyInsteadOfPrompting removes the waiting human for unattended runs. ADK 2.14 replaces a free-form shell string for skill scripts with structured arguments, which leaves less to approve. Agent Framework bounds MCP discovery so that a server cannot hand a client an unlimited catalog. In the Hacker News discussion of the Apiiro report, the Claude Code lead argued that "human attention is limited" and pointed users to auto mode, in which a classifier reviews actions, as safer than manual allow lists.

That argument deserves a fair hearing, and an honest caveat. Replacing a tired human with a classifier does address approval fatigue, but it does not by itself address what gets stored. A secret typed into a command is still in the command, wherever the record is kept. Apiiro compared 16 coding agents from their documentation and says Claude Code is the only one confirmed to write the full approved command to a project file by default, so storage is a product choice with alternatives.

What remains uncertain. The Apiiro figures come from a vendor and were not tested against live systems. We have not measured how often deny rules failed before the fix, and we cannot say how well classifiers catch secrets in commands, since Anthropic says it is still prototyping approaches.

Analysis: Review your agent setup for residue, and treat a permission as data with a lifetime. For each approval path at Belgavi's Book Store, Jenya could write down where the grant is stored, who can read it, when it expires and whether it can contain a secret. Then run one test of each deny rule with quoted and escaped forms of the forbidden command. An approval system is only as trustworthy as the things it leaves behind.

Sources and evidence

Agent approvals are becoming stored records: Apiiro's secrets count, a Claude Code deny-rule fix for quoted commands, and Agent Framework's per-scope binding show the risks of persistent grants. Tools are moving control out of the prompt, but classifiers do not fix what gets stored. Record where each grant lives, who can read it, and test deny rules with quoted forms.