Janus: a Playground for User-Involved Agentic Permission Management

summary

The gist

The gist The authors introduce Janus, a playground system for implementing and evaluating user-involved agentic permission management designs to explore how different approaches affect usability and

In short

Janus is a system designed to test and evaluate different ways users can be involved in controlling AI agents' tool use permissions. It tests six distinct permission management designs across various scenarios, showing that user input is critical for security and privacy. The findings suggest that context-sensitive design is necessary because no single approach works best everywhere.

Key concepts

Conceptual Model: This model describes the agent's flow: the user gives a task, the agent plans actions like tool calls, and a permission module decides if those calls are allowed. It shows how user input fits into this cycle to control what actions are taken.
Design Axes for Permission Management: These are key dimensions used to categorize different permission systems. They include using fixed rules (persistent policies), the agent's autonomy, the level of user involvement during setup or runtime, and how data is used to make decisions.
Permission Assistant Implementations: These are specific ways a system can ask for or manage permissions. Examples include risk assessment (using an LLM to judge danger), auto-approval, requiring explicit user confirmation before every action, and providing suggestions for new rules.

Terminology used across episodes

Reinforcement Learning (RL) — explained in 26 episodes
Flow Matching — explained in 22 episodes
Quantum Fisher Information (QFI) — explained in 21 episodes
Retrieval-Augmented Generation (RAG) — explained in 21 episodes
Sample Complexity — explained in 20 episodes
Federated Learning — explained in 18 episodes

This episode discusses

The paper

Janus: a Playground for User-Involved Agentic Permission Management · Read on arXiv

Natalie Grace Brigham, Eugene Bagdasarian, Tadayoshi Kohno, Franziska Roesner

University of Washington · University of Massachusetts Amherst · Georgetown University

AI agents that autonomously execute tool calls on a user's behalf raise pressing questions about permission management: what role could users play, and what role should they play? Despite many proposed approaches, the user's role in agentic permission management remains underexplored. We introduce Janus, a playground system for implementing and evaluating user-involved agentic permission management designs. Janus consists of two components: Janus-Core, a modular agentic system supporting a diverse spectrum of permission management designs, and Janus-Harness, an automated evaluation framework. Grounded in a conceptual model that identifies key design axes for user involvement, we implement six permission assistants spanning the design space and evaluate them across three scenarios with four subscenarios each and three synthetic responders. We demonstrate that user involvement is critical and can strengthen privacy and security and that user behavior such as permission fatigue must be accounted for in system design. No single design performs optimally across all contexts, motivating a more principled and context-sensitive approach to deploying permission assistants in agentic systems. Janus is publicly available to support future investigation into this dimension of agentic system design.

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: We're looking at the paper: "Janus: a Playground for User-Involved Agentic Permission Management".

Jane: Here's the gist of the paper. The gist The authors introduce Janus, a playground system for implementing and evaluating user-involved agentic permission management designs to explore how different approaches affect usability and efficacy in preventing adversarial or inappropriate tool calls.

Tom: Conceptual Model The conceptual model articulates a framework for describing, reasoning about, and comparing different permission management approaches in agentic systems <ref:2607.01510#pg4>.

Jane: It describes the flow where the user supplies tasks to be completed, the agent determines actions like tool calls or responses, and a permission management module decides whether a tool call is permitted or not <ref:2607.01510#pg4>.

Tom: The control flows as follows: 1) The user sends a message to the agent (e.g., “Schedule a meeting today with Joe”).

Paper summary: Tom: So, we’re talking about the Janus paper again. We just covered that it introduces this playground system to test different ways users can get involved in controlling an AI agent's tool calls.

Jane: That’s right. The authors set up this modular system called Janus-Core for the agent and Janus-Harness for the evaluation framework, which lets them compare these different permission management designs side by side.

Lu: They built Janus-Core to be modular, breaking the permission management component into two pieces: one part that checks calls against fixed rules, and another part called the permission assistant that handles things beyond those fixed rules.

Meng: So, they have a policy manager for the static stuff and then this separate assistant layer for when things get tricky? What does that mean for actual running a model?

Tom: It means when an agent suggests a tool call, first the policy manager deterministically checks it against the static rules, and if no rule allows it, then they invoke that permission assistant.

Jane: And they implemented six different permission assistants to represent different points in this design space. They have risk assessment, auto approve, user confirmation—you name it.

Lu: Those six assistants span the key design axes we talked about earlier: persistent policies, the level of autonomy of the agent, and how much user involvement there is at runtime.

Meng: I wonder how they handle scaling this up to real traffic? Is running this whole system too heavy for production?

Tom: They focused on making it modular so you can swap out those assistants easily, and they output detailed logs of all interactions between the modules to let you analyze each assistant individually.

Jane: They then used Janus-Harness with three scenarios—personal email triage, calendar management, and team collaboration—and tested them against synthetic responders.

Lu: The synthetic responders are really smart because they simulate user behavior; they can be always yes, always no, or alignment aware of the user’s intent.

Meng: So it’s not just running a test script; they are simulating real users reacting in different ways to the AI's requests? That sounds more realistic for deployment concerns.

Tom: Exactly. It lets them see how different combinations of the agent's behavior and the user's reaction affect whether a tool call gets executed or blocked.

Jane: The paper’s main contribution is demonstrating that user involvement is critical for privacy and security, even when we’re using AI to augment those decisions.

Lu: They show that while AI can help reduce cognitive load, it doesn't replace the need for careful permission management strategies guided by user input.

Meng: So the message is that you can’t just blindly let an agent run freely; you have to build in these checkpoints where a human, or a policy mechanism driven by human intent, gets involved.

Tom: That’s the gist of it—it’s not about replacing the agent entirely, but building smart guardrails around its actions based on user context and input.

Conclusion: Tom: So wrapping up the Janus paper, we have a system called Janus that lets us play around with different ways users can manage permissions for agents.

Jane: It’s a playground, which means it lets researchers test out six different permission assistant designs across various user involvement levels and scenarios to see what works best.

Lu: The authors highlight that the key finding is that user input is critical; it can seriously boost privacy and security while also helping AI augment those decisions by lowering the cognitive load.

Meng: So for us in production, it’s a reminder that we need to consider not just the technical safety of the agent, but how user-facing controls affect usability and fatigue.

Tom: Right. And they emphasize that designers should look at both the potential attack rates and how often those bad calls happen, plus the interactions between a permission assistant and the actual user.

Jane: They conclude that effective permission management has to be context-based design, because what you accept in terms of uncertainty depends deeply on the application's domain and its specific risks.

Lu: The paper provides a foundation for designing user studies where you can actually test specific hypotheses about permission management by using Janus’s framework and scenarios.

Meng: It’s a useful tool for testing ideas, but the authors also flag that the combination of their designs and user behaviors could result in blocking the execution of tool calls that we actually want to happen.

Tom: So they are saying that there's a trade-off between security and functionality, and we need to figure out where that balance lands for any given application.

More episodes

← Home