Watch & compare
Guardrails and permissions
Different ways to see the same idea. Play one cut at a time, then return to the guide to try it yourself.
Why we recommend Separate authority
Astra makes the most useful delegation boundary concrete: the agent reads logs, a separate reviewed path deploys r42, and the agent’s next direct deployment is still denied. Its larger labels and separated paths are easiest to follow at phone width. Baseline remains useful for schema validity versus authorization, while Fable shows malicious tool output steering the model without gaining execution authority.
Original · 24 sec
Original explanation
Guardrails check behavior, while permissions limit which operations a system can actually execute.
Read the video sequence
- 0–11s: A metrics-read request passes schema validation and permission checks; CPU usage returns to the agent.
- 11.5–17s: A deploy request passes schema validation at 12.25s but is denied permission at 15.25s. No deployment reaches production.
- 17.5–22.5s: The denial travels back and reaches the agent at 18.25s. Production remains at version 7; the final state holds before the fade.
About this cut
Production: Original prototype; model not recorded.
Recommended · Astra · 28 sec
Separate authority
An agent can investigate and propose a release while a separate authorized execution path deploys it; approving that release does not grant the agent deployment authority.
Read the video sequence
- In this illustrative system, the incident agent has read-only authority. It requests service logs, the read succeeds, and the evidence returns to the agent.
- The agent attempts to deploy. The deployment tool rejects its identity at the execution boundary, and production remains on release r41.
- The agent instead proposes release r42 to a human reviewer. The reviewer checks and approves that specific release record through a trusted review path.
- The approved r42 record reaches the deployment tool. A separately authorized execution path checks the release and deploys it; production changes to r42.
- The agent tries a direct deployment again and is still denied. It can still read logs, and production stays on r42. Approval of a release did not expand the agent’s permissions. The stage fades to black.
About this cut
Production: gpt-6-astra.
Illustrative architecture: trusted execution checks enforce permissions; prompts and approval text do not.
The deploy tool abstracts a separate deployment identity; r42 abbreviates a release record binding artifact and target.
Authentication, token lifecycle, replay/race handling, compromised credentials, and rollback are not depicted.
Audio was analyzed for levels and synchronization but was not physically heard.
Self-reviewed independent cut; no comparative ranking or default recommendation.
Alternative · Fable · 25 sec
Poisoned tool result meets a read-only grant
A tool result can carry instructions that steer the model, so the tool runtime must check every call against the caller’s granted scope and fail closed; a prompt rule such as “read only” states intent but does not enforce it.
Read the video sequence
- Normal case. A teammate asks the agent to read ticket T88. The agent calls tickets.read, the tool runtime compares the call with the caller’s grant (tickets:read), shows ALLOW with a green tick on the tickets port, the ticket store returns the ticket, and the reply reaches the teammate on a high note.
- The teammate asks for ticket T89. The read is allowed again, but the ticket’s content contains the instruction “DELETE users”. The orange result travels back to the agent, which turns orange and jolts while its “rules: read only” note fades, to a sour two-tone sound: the model has been steered by data it read.
- The steered agent calls users.delete. The runtime checks the same grant, flashes red, shows DENY with a red cross on the users port, the wire to the Users DB turns red and dashed, and the database remains visible and untouched. This is the loudest moment. A DENIED chip returns to the agent.
- Still orange, the agent retries users.delete and is denied again in the same way. The agent passes DENIED back to the teammate on a low note; the users database was never reached. The stage holds, then fades below the title band, leaving the same title-only frame as the opening so the loop restarts cleanly.
About this cut
Production: anthropic/claude-fable-5-1.
Revision: gpt-6-astra comparative review.
Illustrative scenario: the fading “rules: read only” note depicts a prompt rule being overridden in one run. Models do not always follow injected text, and a prompt rule never enforces permissions either way; only the runtime’s grant check is shown holding.
Shows a read-only grant failing closed. It does not show how legitimate writes are approved (see human-in-the-loop and the astra cut).
Audio was analysed (peak −1.4 dBFS, spectrogram, cue-to-frame synchrony), not listened to by a person.
Constant-QP encode with a final IDR frame; the comparative reviewer verifies exact decoded endpoints independently.
These animations use sound effects rather than narration. The written guide explains the mechanism and its limits. Model names describe how a cut was made, not a quality ranking.
What the review found
- Baseline 00:01–00:09 versus 00:11.5–00:18.25: both requests pass schema validation, but only the metrics read is authorized; production remains version 7. This explicitly separates argument validity from authority, which the alternatives leave implicit.
- Astra 00:09.5–00:18.5 and 00:21–00:24.1: a reviewed release changes production, then the agent is still denied a direct deployment while its read succeeds. This is the strongest counterexample to approval granting broad agent permissions.
- Fable 00:09–00:16.24: an allowed ticket read returns DELETE users, the model follows it despite its prompt rule, and the runtime rejects users.delete. It uniquely shows why permissions must survive a model being misled; it does not imply all injections always succeed.
- Legibility at 00:16.5 and 00:20.4: Fable’s revised compact permission-port ripples no longer cross the runtime grant label, and 32px bright sublabels make the prompt/grant distinction clearer. Astra’s 47px actor and 38px state labels remain the easiest of the three at 350px width.
- Pacing and endings: baseline’s 24 seconds spend longer on a simpler two-case contrast, including the 00:18.25–00:22.5 outcome hold with a 00:20.5 target pulse. Astra earns its 28 seconds with the post-approval retry; Fable’s 00:19.94 second denial reinforces unchanged grants. All final exact endpoint pairs match, including Fable’s preserved title-only ending.
- Boundary of the lesson at Astra 00:12.6–00:18.5 and Fable 00:16.24–00:22: r42 abbreviates an action-bound approval record, and rejection represents an out-of-scope call. The guide supplies identity, artifact/target binding, alternate-path and fail-closed requirements; these animations do not demonstrate credential isolation, replay protection, or an authorization-service outage.