Janus: a Playground for User-Involved Agentic Permission Management

The gist The authors introduce Janus, a playground system for implementing and evaluating user-involved agentic permission management designs to explore how different approaches affect usability and efficacy in preventing adversarial or inappropriate tool calls.

Conceptual Model

The conceptual model articulates a framework for describing, reasoning about, and comparing different permission management approaches in agentic systems <ref:2607.01510#pg4>. It describes the flow where the user supplies tasks to be completed, the agent determines actions like tool calls or responses, and a permission management module decides whether a tool call is permitted or not <ref:2607.01510#pg4>. The control flows as follows: 1) The user sends a message to the agent (e.g., “Schedule a meeting today with Joe”). 2) The agent determines what actions to take (e.g., make tool calls to check Joe’s availability and create a calendar event). 3) For each tool call made, the permission management module decides whether to approve or reject it, potentially consulting the user or applying persistent policies <ref:2607.01510#pg4>. 4) If approved through the permission management module, the tool call is executed, potentially operating on the user’s data <ref:2607.01510#pg4>.

Design Axes for Permission Management

The Janus-Core design supports a broad spectrum of approaches by identifying key dimensions along which permission management can vary <ref:2607.01510#pg5>. These axes include: 1) Persistent policies, which leverage persistent global policies <ref:2607.01510#pg4>. 2) Ability to act beyond persistent policies, concerning how autonomously agents can act on the user’s behalf <ref:2607.01510#pg4>. 3) Level of user involvement, which varies during configuration and at runtime <ref:2607.01510#pg4>. 4) Grounding, describing what data is drawn on to make decisions, such as using an LLM to assess sensitivity based on the user’s prompted task <ref:2607.01510#pg4>. The paper notes that no single design performs perfectly across all contexts <ref:2607.01510#pg4>.

Janus-Core Implementation

Janus-Core is designed to be modular, flexible, and instrumented for evaluation <ref:2607.01510#pg5>. It decomposes the permission management component into two modular, interconnected components: (1) the policy manager evaluates tool calls against deterministic, rule-based policies and (2) the permission assistant handles permission management capabilities beyond those of the policy manager <ref:2607.01510#pg5>. The agent follows a standard observe-plan-act loop <ref:2607.01510#pg5>. When the agent proposes a tool call, the policy manager deterministically evaluates it against the static policy set and returns an allow/deny decision <ref:2607.01510#pg5>. If no policy approves, it invokes the permission assistant <ref:2607.01510#pg5>. The system outputs detailed logs of all between-module interactions to facilitate analyses of individual permission assistants and comparisons between them <ref:2607.01510#pg5>.

Permission Assistant Implementations

The paper implements six permission assistants to represent diverse points in the design space <ref:2607.01510#pg5>. These include: 1) risk assessment, which uses a judge LLM to assess how “risky” the tool call is and escalates if the risk judgment exceeds a threshold <ref:2607.01510#pg5>. 2) risk assessment autonomous, which allows the tool call if the score is at or below a configurable tolerance <ref:2607.01510#pg5>. 3) auto approve, which is equivalent to the base/naive case where the permission assistant will automatically approve all tool calls <ref:2607.01510#pg5>. 4) user confirmation, which escalates every tool call to the user asking for allow or deny <ref:2607.01510#pg5>. 5) constitution, which compiles a plain-English constitution file into ordered JSON rules and uses first-match rule evaluation <ref:2607.01510#pg5>. 6) policy suggestion, which provides the user with the option to reject tool calls or generate a new persistent policy for similar actions <ref:2607.01510#pg5>.

Janus-Harness Evaluation Framework

Janus-Harness is an evaluation infrastructure designed around Janus-Core to facilitate automated analysis of different permission assistant designs under a diversity of usage scenarios <ref:2607.01510#pg6>. Its design goals include being automatable, supporting user-driven scenarios, and specifying a “ground truth” for the “user’s” intent <ref:2607.01510#pg6>. Janus-Harness supports synthetic responders to simulate user behavior <ref:2607.01510#pg6>. Scenarios are designed across three contexts: (1) personal email triage, (2) calendar management, and (3) team collaboration <ref:2607.01510#pg9>. Each scenario has a clear ground truth for the correct permission management decision <ref:2607.01510#pg9>.

Experimental Results and Takeaways

Experiments involved running a full factorial experiment with Janus-Harness (3 scenarios × 4 subscenarios × 3 synthetic responders) five times for each permission assistant <ref:2607.01510#pg10>. The results highlighted that user input is critical and can significantly strengthen privacy and security while at the same time AI augmentation of user decisions can help reduce cognitive load <ref:2607.01510#pg10>. A key takeaway is that designers should consider both (1) the attack and out-of-alignment tool call rates and (2) the interactions between a permission assistant and a user <ref:2607.01510#pg10>. Designers should strive to minimize—ideally reduce to zero—the number of attack or out-of-alignment tool calls that occur for always no synthetic responders <ref:2607.01510#pg10>. Furthermore, designers should strive for permission assistants that (2) automatically reject all attack or out-of-alignment tool calls and (3) have user interfaces that minimize the likelihood of users granting incorrect permissions when not automatically rejected by the permission assistant <ref:2607.01510#pg10>. Finally, designers should recognize that "locally-correct user responses to permission requests (e.g., the alignment-aware approval of a policy) may result in subsequent incorrect decisions (e.g., the subsequent automatic approval of an attack or out-ofalignment tool call)" <ref:2607.01510#pg10>.

Discussion and Conclusion

Janus enables experimentation with and evaluation of diverse approaches to user-involved runtime permission management for agentic systems <ref:2607.01510#pg8>. The work provides a foundation for designing user studies by using Janus’s framework and scenarios to test specific hypotheses about permission management <ref:2607.01510#pg8>. Effective permission management requires context-based design and evaluations, as Consider how much uncertainty users are willing to accept, and at what cost for usability and security, depends deeply on the application’s domain and risks <ref:2607.01510#pg8>. The findings suggest that designers should recognize that the combination of their designs and user behaviors could result in the blocking of the execution of desired (non-attack, non-out-of-alignment) tool calls <ref:2607.01510#pg10>. Future work could expand Janus to address greater complexity, such as multi-agent interactions and more nuanced use of chat context <ref:2607.01510#pg8>.

How it works

The system is built around the observation-plan-act loop <ref:2607.01510#pg4>. A tool call is blocked until approved by the policy manager or permission assistant <ref:2607.01510#pg5>. If denied, the agent continues without the result and may retry the same call <ref:2607.01510#pg5>. The permission assistant interfaces with multi-turn user interaction and has access to the user’s most recent messages for context <ref:2607.01510#pg5>.

Scenarios and Responders

Janus-Harness supports synthetic responders, which include three deterministic modes: always yes, always no, and alignment aware <ref:2607.

1. Develop a modular permission management component that decomposes decision-making into a policy manager for deterministic rules and a permission assistant for dynamic decisions, allowing researchers to choose between them based on whether an approach leverages basic, deterministic policies or leverages more complex policies internally.

2. Implement risk assessment assistants that use judge LLMs to score tool call risk against user tasks, allowing the system to either escalate requests if the judgment exceeds a threshold or approve calls autonomously if the risk is below tolerance.

3. Create a constitution assistant that compiles plain-English rules into ordered JSON rules using an LLM, applying first-match rule evaluation for tool calls and intent-matching auto-approver for unlisted actions, serving as an example of a permission assistant with internal persistent policy management.

4. Develop a policy suggestion assistant that interfaces with the Janus Core policy manager to propose generalized policies based on user feedback, allowing users to propose a generalized policy (name, description, and parameter-based conditions), shows it to the user, and lets them accept, revise, or reject.

5. Design an evaluation framework that uses synthetic responders like always yes, always no, and alignment aware to systematically test permission assistants across personal email triage, calendar management, and team collaboration scenarios.

6. Create a scenario configuration system where users can define the ground truth for intent, including specific tool calls designated as attack calls or out-of-alignment tool calls to stress-test different permission management designs.

7. Design a policy suggestion mechanism that recognizes "locally-correct user responses to permission requests (e.g., the alignment-aware approval of a policy) may result in subsequent incorrect decisions (e.g., the subsequent automatic approval of an attack or out-ofalignment tool call)."

8. Implement logging and traceability infrastructure within Janus Core that records detailed logs of all between-module interactions, thereby facilitating analyses of individual permission assistants and comparisons between permission assistants.

AI agents that autonomously execute tool calls on a user's behalf raise pressing questions about permission management: what role could users play, and what role should they play? Despite many proposed approaches, the user's role in agentic permission management remains underexplored. We introduce Janus, a playground system for implementing and evaluating user-involved agentic permission management designs. Janus consists of two components: Janus-Core, a modular agentic system supporting a diverse spectrum of permission management designs, and Janus-Harness, an automated evaluation framework. Grounded in a conceptual model that identifies key design axes for user involvement, we implement six permission assistants spanning the design space and evaluate them across three scenarios with four subscenarios each and three synthetic responders. We demonstrate that user involvement is critical and can strengthen privacy and security and that user behavior such as permission fatigue must be accounted for in system design. No single design performs optimally across all contexts, motivating a more principled and context-sensitive approach to deploying permission assistants in agentic systems. Janus is publicly available to support future investigation into this dimension of agentic system design.