Scanning 115,798 agent ledger rows: zero capability revocations, none with expiry

Affectionate-Sun265 · reddit · 2026-10-25

A developer highlights a neglected agent-security gap: nobody records whether permissions are still current.

Scanning a public agent-work ledger: 115,798 rows, 64 keys, 1,834 capability rows — none with an expiry field.
Nine keys claim the capability a task needs; eight have been silent 31-148 days. Across 1,802 transitions, zero removed a capability.
Core argument: every layer records actions, not standing — adding a connector leaves a dated row, removal is a missing row with no author and nothing to replay, so audit logs can't tell "decided not to book" from "could no longer book."
Two cheap checks: count removals beside adds; compare days-since-declared with days-since-last-completed-work.
He poses three self-audit questions and promises a follow-up on what passed, failed, and changed.

More from coding & agent