Least-privilege by default
Most AI workflows end up with broad access not because anyone decided they should — but because access was never declared. The fix isn't more review meetings. It's putting permission in the definition.
Access you discover in production
When a workflow is wired together in a UI builder or a pile of scripts, its real reach is implicit: which systems it can read, what it can write, which keys it holds. Nobody can answer "what is the blast radius?" without tracing the whole thing — usually after something has already gone wrong.
Declare it up front
In ProxyLang, a workflow grants only the reads and writes it needs, at the top, in the text:
workflow lead_router { on event("form.submitted") permit agent.read = [crm, enrichment] permit agent.write = [crm] # least privilege audit all }
The grant is in the diff. Reviewing the file tells you exactly what the system is able to do — which is the single most load-bearing property of a definition you can read.
Default-deny, enforced at runtime
The runtime evaluates permissions default-deny: an action is refused unless an explicit grant allows it. The planner can propose; the runtime disposes — and records every decision in a tamper-evident audit log. Capability is declared at definition time, enforced at run time, and visible in review the whole way through.