{"schema":"OTR-CURRENT-SIGNAL-READER-1","presentationSchema":"OTR-SIGNAL-SLIDES-1","signalId":"PDF-f2785c8841ffad2421df3b01-13","canonicalUrl":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/","title":"The next AI upgrade is a permission boundary","category":"Technology","representation":"current-guided-reader","originalResearch":"preserved-separately","sources":[{"title":"blogs.windows.com ↗","url":"https://blogs.windows.com/windowsdeveloper/2026/10/07/microsoft-execution-containers-policy-driven-containment-for-ai-agents/","contexts":["OTR EMERGING DATA","OnTheRice’s Emerging Data","Source confidence","Key points","What could change this view?","Bottom line","Evidence behind this view","Evidence against this view","What people say vs the facts","How likely is this call? · Three frameworks","Sources, original wording and price checks","See how the pieces connect","What changed","OTR reasoning","Counterpoint","Evidence, memory & review 2 linked sources"]},{"title":"research.google ↗","url":"https://research.google/blog/open-and-emergent-problems-in-agentic-privacy-and-security-a-contextual-angle/","contexts":["OTR EMERGING DATA","OnTheRice’s Emerging Data","Source confidence","Key points","What could change this view?","Bottom line","Evidence behind this view","Evidence against this view","What people say vs the facts","How likely is this call? · Three frameworks","Sources, original wording and price checks","See how the pieces connect","What changed","OTR reasoning","Counterpoint","Evidence, memory & review 2 linked sources"]}],"chapters":[{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-1","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-1","title":"OTR EMERGING DATA","topic":"emerging","kind":"cover","text":"Start with the main idea: what may be changing, how the clues connect, and what remains uncertain. We see AI permission controls becoming part of the product itself. A helpful agent can still damage a system if it inherits more access than its task needs. Microsoft’s containment launch addresses that gap at the operating-system level. Agent privacy research points to a second difficulty: the same action can be acceptable in one setting and wrong in another. Restricting files and networks is therefore a foundation, not a complete definition of good judgement. For teams using agents, the emerging opportunity is clearer delegation. We expect useful demonstrations to show both a task that succeeds and an unrelated action that is blocked. A safe boundary earns trust by holding when the agent tries to cross it.","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-2","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-2","title":"The idea, step by step","topic":"emerging","kind":"research","text":"Start with the main idea: what may be changing, how the clues connect, and what remains uncertain. Read the matching explanation in OTR EMERGING DATA .","links":["https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-1"]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-3","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-3","title":"Research context","topic":"evidence","kind":"research","text":"Understand the background and earlier comparisons, including the differences that matter. Review status We refreshed the cited public pages at 20 Oct 2026, 18:14 SGT and checked the wording against the available release stage. Two topical families are present: Microsoft’s product documentation and Google Research’s contextual privacy analysis. They address related problems from different organisations, but neither supplies an independent audit of the other’s solution. Our proposed mechanism and one-week test remain unresolved; we do not claim a completed rollout, an independent audit or publication to the website. Publication and review times Research prepared 20 Oct 2026, 18:33 SGT Research review due 27 Oct 2026, 18:33 SGT Research review due We will review the stated checkpoint by 27 Oct 2026, 18:33 SGT. An earlier source update can change our view before that deadline. LEARNING REVIEWED WITH DISCLOSED LIMITS","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-4","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-4","title":"The key clues","topic":"emerging","kind":"research","text":"See the main observations behind the idea, with their important qualifications. An agent can choose a sensible action that still exceeds the access its owner intended. External access rules address that mismatch, while the privacy research reminds us that technically permitted actions can still be inappropriate for the context. Compare the same authorised task with the same denied files and network destinations before and after containment. A meaningful test includes an attempted boundary crossing as well as a successful task; a product name or settings screen is not enough.","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-5","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-5","title":"What could change this view?","topic":"changes","kind":"research","text":"See what could change this interpretation and what still needs to be checked. Some tools or helpers may sit outside the restricted process. If the full action path is not covered, a successful sandbox demonstration can give a misleading impression of end-to-end protection. A result under those conditions would weaken our proposed connection rather than merely delay its confirmation.","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-6","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-6","title":"What this means","topic":"emerging","kind":"research","text":"Read the takeaway and the limits that matter before drawing a conclusion. Find one documented test that finishes an authorised task while blocking access to an unrelated file or destination. Support requires the denial to be enforced outside the model and the limitation to be visible to the user. We will review the evidence by 27 Oct 2026, 18:14 SGT. If the required comparison is missing, the signal remains unconfirmed rather than receiving an invented outcome. This is research and interpretation, not an investment price forecast. Source verification limits are listed below.","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-7","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-7","title":"Evidence behind this view","topic":"evidence","kind":"research","text":"Review the information supporting this view and the limits on what it can show. Microsoft says Execution Containers are generally available and enforce file and network policies outside an agent. Agent identity integration and some management features are described as coming soon. Google Research identifies open questions in agent privacy and security across system, model and user levels. It frames trust as a research problem that requires attention to context. The archived technology batch described work to stabilise VS Code agent-session identity. It was marked pending independent verification. We use it as historical context for attribution, not evidence that the new containment product works.","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-8","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-8","title":"Evidence against this view","topic":"changes","kind":"research","text":"Check the opposing evidence and other explanations that could weaken this view. We would also retain an inconclusive result when the comparison cannot be made fairly; missing evidence is not a negative finding.","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-9","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-9","title":"How the research changed","topic":"evidence","kind":"research","text":"See what changed in the research and why, while keeping earlier recorded views separate. Learning review before publication The supplied direction was retained: No investible directional call. The supplied synthesis was retained. Reason: Retain the complete supplied research, direction, subjective source judgment and original horizon after six-agent discussion. Apply lessons only as qualitative safeguards for matching clocks, quantities, different reports relying on the same underlying source and explicit gaps. No live-source revalidation, executed entry, calibrated probability, new outcome or production-weight change is claimed. Lessons considered: Use lessons in the next call; Keep the clocks separate; Keep incomplete tests visible; Look for independent evidence; Separate direction from explanation; Compare matching quantities. This review belongs to the new draft before publication. Earlier published calls and their original deadlines remain unchanged.","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-10","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-10","title":"What people say vs the facts","topic":"evidence","kind":"research","text":"Compare what people say with the observations, without treating attention as proof. The product announcement establishes a containment capability, not that agents now act safely in every setting. We separate operating-system restrictions from the wider judgement about what an agent should do with legitimately accessible data. We have not measured public sentiment or assumed what users privately believe. The relevant distinction is between the published capability and the result the proposed test would have to show.","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-11","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-11","title":"Earlier research and limits","topic":"evidence","kind":"research","text":"Check what earlier forecast results are available and what they can tell us. Past results do not guarantee this outcome. The pre-publication learning review is recorded under “Why the direction changed”, including cases where the supplied direction was retained.","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-12","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-12","title":"Understanding the estimated chance","topic":"evidence","kind":"research","text":"See how the stated chance was judged and where the estimate is uncertain. A percentage does not guarantee an outcome. 63% is our subjective, not shown by testing to give reliable probabilities belief that supporting evidence for this specific one-week test will appear. It is not a measured success rate, statistical posterior or prediction of an asset price. The six reviewers recorded these individual checkpoint judgments: Singapore 70%, Technology 69%, Social Media 64%, General 62%, Learning 61%, Corpus 72%. An unavailable value means that reviewer declined to assign a number from the accessible evidence or test definition.","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-13","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-13","title":"See how the pieces connect","topic":"connections","kind":"research","text":"Follow how this part of the research connects to the wider idea, including its limits. Delegating more actions raises the cost of a permission mistake. We therefore connect practical adoption to a boundary that survives an agent’s attempted crossing, alongside a record that explains what was allowed and denied.","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-14","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-14","title":"What changed","topic":"evidence","kind":"research","text":"See what changed in the research and why, while keeping earlier recorded views separate. Recorded public history We see AI permission controls becoming part of the product itself. A helpful agent can still damage a system if it inherits more access than its task needs. Forecast prepared: 20 Oct, 19:13 SGT","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-15","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-15","title":"OTR reasoning · Why we see this connection","topic":"evidence","kind":"research","text":"Follow the reasoning from the observations to the proposed result. A possible link is not proof. Read the matching explanation in OTR EMERGING DATA .","links":["https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-1"]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-16","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-16","title":"Counterpoint · Another possible explanation","topic":"evidence","kind":"research","text":"Check the opposing evidence and other explanations that could weaken this view. Read the matching explanation in Chapter 5 .","links":["https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-5"]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-17","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-17","title":"Evidence, memory & review 2 linked sources","topic":"sources","kind":"research","text":"Check where the information came from, when it was observed and what was verified. Source trail This evidence panel does not assign a score or probability. Any forecast estimate is shown separately with its own source and limitations.","links":[]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-18","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-18","title":"Keep exploring","topic":"connections","kind":"finish","text":"Choose how to follow this Signal or compare it with other research. Track this Signal to find it again, compare the evidence, and revisit its recorded outcome. Explore more Signals →","links":["https://ontherice.org/signals/"]},{"id":"otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-19","url":"https://ontherice.org/signals/PDF-f2785c8841ffad2421df3b01-13/#otr-slide-PDF-f2785c8841ffad2421df3b01-13-detail-19","title":"Terms in simple English","topic":"glossary","kind":"glossary","text":"Find plain meanings for the specialist terms used in this research. Estimates whose accuracy has not been established by testing A judgement that has not been shown to match real outcomes reliably. It is not a proven success rate. AI or machine learning Software learning patterns from examples to perform tasks. Its output can be wrong. UTC and SGT UTC is a world time standard. SGT is Singapore time, eight hours ahead of UTC. Least privilege giving only the access a task needs. Policy rules enforced outside the agent. We use these terms to describe the stated task and conditions, not to imply that a more technical description makes the result more reliable.","links":[]}]}