The Agent Needs More Than a Passing Grade

Apple plans to make granting Full Disk Access on Macs require more explicit user action, according to Monday’s TNW report. The tension is straightforward: an assistant needs enough access to be useful, while the person approving that access needs to understand what usefulness can cost. A permission dialog is doing rather consequential work for something people would prefer to dismiss and get on with lunch.

Tuesday’s Techdirt commentary puts practical consequences beside that problem. It recounts a launch-time Muse vulnerability that could enable spying on Mac users, and a Marketplace incident in which the assistant reportedly sold belongings below acceptable prices and disclosed a home address. Techdirt also notes that the Marketplace user apparently misunderstood the permissions he set. These are reported incidents, including an individual account, rather than one established diagnosis of everything wrong with the product.

The distinction matters. A vulnerability and an authorization misunderstanding require different remedies: fixing exploitable software does not explain a transaction limit, and explaining a transaction limit does not fix exploitable software. Meanwhile, the columnist’s separate claim that Muse knew his private messages is disputed by Meta, as TNW reports. Apple named no app and supplied neither a rollout date nor a technical design. Its proposed change makes authorization the immediate engineering question; whether the implementation makes that authorization intelligible remains the test.

Apple’s explanation identifies the mechanism beneath the permission debate. Full Disk Access largely bypasses platform privacy controls so backup applications can work; some developers now use it in ways that expose files, mail, messages and browsing history, according to TNW. The exception has a legitimate purpose. The engineering problem begins when a broad reading privilege becomes input for software that can act on what it reads.

For an agent review, that suggests separating access from subsequent handling. First establish what the application can obtain. Then trace where a task sends information and what each recipient does with it. Apple also warns that communication-app access can affect the privacy of other participants. That changes the consent calculation: the person clicking approval is not necessarily the only person represented in the material being opened. The permission screen has one operator; the conversation can have several stakeholders.

Cloudflare’s documented Web Search API offers a useful architectural comparison. Its three search providers support Zero Data Retention for requests made through Cloudflare, while search requests also appear in AI Gateway logs, according to Cloudflare. Those statements describe different components, and the announcement does not specify log contents or retention periods. The provider commitment therefore leaves a separate gateway question to answer. There is no failure implied here: the lesson is to keep the scope attached to the promise. A provider’s retention policy cannot stand in for a map of the whole data path.

The complication is that making a model refuse more work can carry a defensive cost. In its Large 4 announcement, Mistral reports an 82% score on a test requiring a model to reproduce a real software vulnerability and then patch it. The vendor attributes several closed models’ near-zero scores on that test to refusals. That is Mistral’s account of the evaluation, but the mechanism it describes deserves consideration: proving a flaw exists can require performing the behavior a filter is designed to stop.

This gives capability testing a distinct job. A security team needs to determine whether its model can perform an authorized investigation, including the difficult parts. Separately, it needs to determine which systems and information the application may reach. Apple’s explanation of the backup exception shows why those decisions cannot be collapsed into a single model-safety score: broad application access remains broad access regardless of how impressively the model answers a cybersecurity test. TNW supplies the permission mechanism; Mistral supplies the functional counterweight.

Mistral also reports 93.3% resistance on Lakera’s public B3 prompt-injection benchmark. That measures resistance to tested attacks, rather than establishing an application’s permission boundaries. Its deployment promise needs similar precision: the announcement describes an API preview and promises weights for the end of its announcement month, making self-deployment prospective. The argument for running security work under an organization’s own policies is useful. The organization still has to write and enforce those policies. Receiving the weights does not cause a permissions architecture to arrive in the same parcel.

For CTOs and engineers, the practical review should produce three separate answers: what the agent can accomplish, what the application is authorized to read or do, and how downstream components handle the information. Mistral’s vulnerability-reproduction example makes the first question concrete: a refusal may prevent completion of a legitimate defensive task. Its proposed self-deployment gives organizations a route toward applying their own policies, once the promised weights are available, according to Mistral. Policy autonomy is a responsibility as well as a feature.

For the data-handling answer, retain the component names. Cloudflare’s documentation identifies search-provider retention commitments and gateway logging separately. A review can preserve that distinction by asking which component receives a request, which component records it, and what rules govern each. Cloudflare’s announcement illustrates why a precise promise is more useful than an expansive privacy adjective: it gives the reviewer a defined commitment to examine and another part of the system to investigate.

Apple’s planned change brings the review back to the person granting authority. Because its implementation and timing remain unspecified, as TNW reports, the meaningful test will be whether explicit approval helps people understand the breadth and consequences of the access. More deliberate clicking may improve consent; the design must make the decision worth deliberating over. An agent can earn a strong task score, operate under an explicit grant and use a provider with a retention commitment. Each fact deserves its own line in the review. None deserves to sign off on the other two.