Tagging AI Agent Actions with rwx Labels: A Rough but Honest Attempt

When AI agents start operating real accounts, a fundamental question surfaces: can this action be undone? A developer on Reddit raised this overlooked yet critical question and offered their answer—rwxmap.

The Essence of the Problem: Agents Don't Know What They're Doing

Most online services offer hundreds of operation endpoints, but no mechanism tells an agent which ones merely read data, which ones modify something recoverable, and which ones are final—deletion, payment, sending a message.

The developer's observation hits the mark: when an AI agent operates real accounts, one core question determines most of the risk—can this action be undone?

Existing solutions are either too coarse, rely on tools declaring themselves, or amount to guesswork behind stricter guardrails. There is no absolute standard for what an agent can or cannot do.

Returning to Computing's Oldest Wisdom: The rwx Permission Model

The developer went back to one of the oldest ideas in computer science—the rwx model of file permissions—and built rwxmap, tagging each operation with a single letter:

• r — read-only operations
• w — changes that can be recovered
• x — operations that cannot be undone

The analogy is elegant. File permission systems have been validated over decades—simple, intuitive, effective. Applying it to agent action classification draws strength from established wisdom.

The developer also submitted an Internet-Draft to the IETF describing how agent permissions should be defined. It should be noted that this is an individual submission, not a standard. The draft describes what a permission grant should contain, while rwxmap does the classification work that must come first.

The rwx model originates from the Unix file permission system, born in Unix v1 in the early 1970s, and remains a cornerstone of operating system permission management today. It divides accessors into owner, group, and others, assigning each category three bits for read (r), write (w), and execute (x). Read permission allows viewing file contents or listing directories; write permission allows modification or deletion; execute permission allows running a file as a program. The reason this model has endured for half a century lies in its orthogonality—the three capabilities are independent of one another, and the eight states they combine into cover nearly all basic access scenarios. But it has clear limitations: it doesn't distinguish between "recoverable writes" and "unrecoverable writes," doesn't express intermediate states of operations, and doesn't account for context dependencies. rwxmap makes a key modification when borrowing this model: it treats r, w, and x not as permission bits but as labels for the nature of operations. In other words, rwx in a file system means "who can do what," while in rwxmap it means "what consequences this operation produces." This shift from describing subject capabilities to describing object effects is the precondition for rwxmap's applicability across services and scenarios.

IETF Internet-Draft is one of the document types of the Internet Engineering Task Force (IETF), used for public discussion of technical proposals before standards are formally established. It is not equivalent to an RFC (Request for Comments), carries no binding force, can be submitted by anyone, and typically has a validity period of six months. Drafts must go through multiple rounds of review and revision and gain at least recognition from domain experts before they might enter the RFC process. The developer's submission of an agent permissions draft to the IETF means this work is attempting to move from a personal project toward community consensus. The draft describes "what a permission grant should contain," focusing on the protocol level—for example, how a service declares the consequence categories of its operations to an agent; rwxmap does the classification work—how to determine which category each operation falls into. The two are in an upstream-downstream relationship: without accurate classification, even the most refined permission protocol cannot be executed.

Two Working Modes and Actual Results

rwxmap supports two modes of use:

1. Pre-labeling an entire service — batch-classifying all operations of a service
2. Real-time evaluation of each call — rating calls one by one as the agent initiates them, even if the service itself provides no description

It can also work with the developer's other project, bareguard: rwxmap labels the call, and bareguard decides whether the agent can execute it.

The developer candidly published test data: in a blind test of 4,279 operations from unseen services, standalone use achieved about 82% accuracy, rising to 93% when paired with Jev TypeSafe AI (an optional AI classifier). When uncertain, it chooses the stricter label, so errors tend toward the safe direction—overly permissive results are under 1%.

A Rough but Honest Engineering Attitude

The developer's own assessment: "Under-specified, held together by guardrails. A starting point, not a standard."

This kind of honesty is not common in the AI field. Most projects tend to exaggerate their capabilities, while this developer chose to clearly mark limitations. 82% accuracy means one in five operations may be misclassified—for high-risk scenarios, that number is clearly insufficient. But as the developer says, errors tend toward the safe direction, which mitigates the problem to some extent.

The project is open source; both rwxmap and bareguard are available on GitHub (github.com/hamr0/rwxmap and github.com/hamr0/bareguard).

When uncertain, the classifier chooses the stricter label—a principle known in safety engineering as "fail-safe" or "fail-closed." Its logic is: when the system cannot determine whether an operation is recoverable or unrecoverable, it classifies it as unrecoverable, thereby preventing the agent from executing it. The counterpart is "fail-open," meaning letting it through when uncertain. Safety-sensitive systems universally adopt fail-safe strategies—firewalls dropping unknown traffic by default, authentication systems rejecting unverified requests by default—all follow the same reasoning. rwxmap's test data shows overly permissive errors are under 1%, indicating the fail-safe mechanism works correctly in the vast majority of uncertain scenarios. But this strategy has a cost: it may block some operations that are actually recoverable, reducing the agent's effective capability. How to balance safety and efficiency is a question any fail-safe system must face, and rwxmap chooses to prioritize safety over efficiency.

Why This Problem Deserves More Attention

Current hotspots in the AI agent field focus on capability improvements—more complex reasoning, longer contexts, more tool calls. But the question of permissions and safety boundaries is equally critical, yet far from receiving the attention it deserves.

Imagine an agent with permissions to delete files, send emails, and execute payments, yet unable to distinguish which operations are irreversible—this is itself a massive security hazard. The value of rwxmap lies not in how polished it is, but in that it raises the right question and offers a discussable, iterable starting point.

Whether this analogy from file permissions to agent permissions fully applies remains open for discussion. The operational semantics of web services are far more complex than file systems, with stronger context dependencies. But a directional answer is always better than no answer at all.

One-line Summary

rwxmap borrows the file permission model to provide recoverability classification for AI agent operations, with accuracy up to 93%.

Paragraph Summary

The article introduces rwxmap, a solution proposed by a developer for the core problem of whether AI agent operations on real accounts can be undone. The tool borrows computing's classic rwx file permission model, labeling each operation as read-only (r), recoverable (w), or irreversible (x). rwxmap supports both pre-labeling entire services and real-time evaluation of each call, and can work with bareguard for complete permission control. In a blind test of 4,279 unseen services, standalone accuracy was about 82%, rising to 93% with an AI classifier, with uncertain cases tending toward stricter labels and overly permissive errors under 1%. The developer candidly notes the project is under-specified, positioned as a starting point rather than a standard, and it is now open source. The article notes that permission and safety boundary issues remain far from receiving due attention in the AI agent field, and rwxmap's value lies in raising the right question and offering an iterable starting point.