Why Retrieval Is Not Permission
The sentence "retrieval is not permission" sounds almost obvious — until you look at how most agent stacks actually work. This article explains why the concept is the load-bearing wall of agent security, and why conflating the two is the root cause of most agent breaches.
Two separate decisions
When an agent retrieves a document or recalls a memory, two logically distinct things happen:
- Retrieval — content enters context. This is an information decision: "this content is relevant."
- Permission — the content may cause an action. This is an authority decision: "this content is trusted enough to act on."
Most agent frameworks collapse these into one step: retrieve content, then let the model act on whatever it retrieved. The model then treats a malicious document's instruction with the same authority as the system prompt — because nothing in the pipeline distinguished "this is relevant" from "this may issue commands."
Why the collapse is dangerous
The moment retrieval and permission are merged, prompt injection becomes trivially powerful. An attacker doesn't need to break any technical control — they just need their content to be retrieved. Once it's in context, it inherits the authority of everything else in context.
send_email fires with attacker-controlled content. The breach.What enforcement actually looks like
Separating the two decisions means inserting a gate between them — at the boundary where a decision becomes an action. The gate doesn't try to make the model distrust content. It lets content be retrieved freely (retrieval), then independently verifies, before any action executes, whether the provenance of that action carries the authority to perform it (permission).
- Origin-bound authority. An action driven by content from an untrusted origin does not carry trusted-origin authority.
- No derivation amplification. Recalled content can't gain more authority than its source chain had.
- Action-time re-scoring. The authority check happens when the action fires, not when the content was read.
Read the content. Then ask: does this content's origin have the right to cause this action? Those are two questions. Enforce them as two checks and the injection loses its payload.
The mental model
Think of an agent's context as a library, not a command channel. Putting a book on the reading table doesn't give the book a vote on what you do next. AgentInterdict enforces exactly that: reading happens freely, but the authority to act is verified independently, at the moment of action.