File System Access Controls for AI Agents

File system access is one of the most commonly granted and most dangerous agent capabilities. An agent with unrestricted file access can read sensitive configuration files, overwrite critical data, or exfiltrate information. Proper access controls are non-negotiable for production deployments.

Path-Based Policies

Define explicit rules for which directories and files an agent can access. Authensor's policy engine evaluates file operations as action envelopes containing the operation type (read, write, delete, list) and the target path.

Allowlisted paths define the directories the agent can access. A content writing agent might have write access to /content/drafts/ and read access to /content/published/ with no access to anything else.

Blocked paths explicitly deny access to sensitive locations. Always block: .env files, .git directories, node_modules, credential files, SSH keys, and configuration directories.

Path normalization prevents bypass through relative paths, symlinks, and path traversal sequences. Resolve all paths to their canonical form before evaluation. The string ../../etc/passwd must resolve to /etc/passwd and be evaluated against your policy.

Operation-Level Controls

Differentiate between read, write, create, delete, and list operations. An agent might need to read files in a directory but should never delete them. Authensor policies support per-operation rules for each path.

Write restrictions are especially important. Limit which files the agent can modify. Require that write operations target specific file extensions (like .md or .txt) to prevent the agent from creating executable files.

Delete protection should require explicit authorization or human approval for any delete operation. Make deletion a high-privilege action that triggers an approval workflow.

Content Scanning

Scan file contents before they enter the agent's context. Files in your repository might contain prompt injection payloads, either planted by an attacker or present in user-generated content.

Scan agent-written content before it is persisted. Verify that outputs do not contain injected instructions, malicious code, or sensitive information from other sources.

Monitoring and Audit

Log every file operation with the full path, operation type, file size, and policy decision. Authensor's receipt chain provides a complete record of file system interactions.

Monitor for unusual patterns: rapid file enumeration (potential data discovery), large file reads (potential exfiltration), writes to unexpected locations, or access patterns that do not match the agent's task.

Alert on any file access outside the agent's configured scope. Even denied accesses indicate that something prompted the agent to try, which warrants investigation.