When we let AI agents act on real accounts, one question decides most of the risk: can this action be undone?
Most services offer hundreds of actions, and nothing tells the agent which ones only look, which ones change something you can change back, and which ones are final: a deletion, a payment, a message sent.
I went back to one of the oldest ideas in computing, the rwx of file permissions, and built rwxmap to put one of those letters on every action:
r — only reads
w — a change that can be set back
x — cannot be undone
There are proposals for this, but I couldn't find a standard answer for online services to "can this action be undone?" What exists is coarse, self-declared by the tool itself, or guesswork behind tighter guardrails. There is no absolute ruling on what an agent may or may not do, and rwxmap doesn't claim one.
I built it alongside an Internet-Draft I submitted to the IETF on how an agent's permissions should be scoped. The draft is an individual submission, not a standard. It describes what a permission grant should say; rwxmap does the sorting that has to come first.
It works two ways: label a whole service up front, or rate each call on the fly as the agent makes it, even when the service describes nothing. And it pairs with bareguard, my gate for agents with scoped permissions: rwxmap labels the call, bareguard decides whether the agent may make it.
It isn't perfect, and I'd rather say so plainly. On one blind test of 4,279 actions from services it had never seen, it got about 82% exactly right on its own and 93% with Jev TypeSafe AI, an optional AI classifier pass. When it's unsure it picks the stricter letter, so its mistakes lean safe: under 1% came out too permissive. It's underspecified and held together by guardrails. It's a head start, not a standard.
Open source: github.com/hamr0/rwxmap
bareguard: github.com/hamr0/bareguard
ietf: https://datatracker.ietf.or...