Janus: a Playground for User-Involved Agentic Permission Management

What Happened

The preprint "Janus: a Playground for User-Involved Agentic Permission Management" tackles a fundamental tension in autonomous AI agents: how to balance user control with the efficiency gains of automation. The paper introduces a framework—Janus—designed as a testbed for studying permission management when AI agents execute tool calls on behalf of users. Rather than prescribing a single solution, Janus provides a modular environment where researchers can experiment with different permission models, from fully autonomous execution to granular user-approval workflows.

The core innovation is the explicit recognition that permission management is not a binary choice (allow/deny) but a spectrum. Janus allows researchers to vary factors like permission granularity (per-call vs. per-session), user interruption frequency, and agent transparency. The system logs user-agent interactions, enabling quantitative analysis of trade-offs between user workload, task completion time, and safety outcomes.

Why It Matters

This research addresses a critical blind spot in current agentic AI development. Most production systems—from coding assistants to browser automation tools—default to either full autonomy (dangerous) or constant user confirmation (impractical). Neither extreme works at scale. Janus provides a much-needed empirical foundation for designing permission systems that are both secure and usable.

The timing is significant. As AI agents move from demo to deployment, incidents of unauthorized tool calls—accidental file deletions, unintended API charges, or privacy violations—are becoming more common. Without systematic permission management, these failures will erode user trust and invite regulatory backlash. Janus offers a way to study these failure modes before they happen in production.

For the broader field, this work highlights that agent safety is not solely a technical problem of model alignment. It is also a human-computer interaction problem. The optimal permission policy depends on user expertise, task criticality, and context—factors that static rule-based systems cannot capture. Janus enables dynamic, context-aware permission models that adapt to user behavior over time.

Implications for AI Practitioners

First, permission management should be treated as a first-class design concern, not an afterthought. Practitioners building agentic systems should consider implementing modular permission layers that can be tuned based on user feedback and risk assessment. Janus provides a reference architecture for doing so.

Second, the research underscores the value of user-in-the-loop evaluation. Rather than relying solely on synthetic benchmarks, teams should collect real interaction data to understand when users prefer to delegate versus intervene. This data can inform both UX design and model training.

Third, the findings suggest that one-size-fits-all permission policies are inadequate. High-stakes domains (finance, healthcare) will require stricter controls, while low-risk tasks (web searches, calendar lookups) can tolerate more autonomy. Practitioners should design systems that allow per-domain or per-task permission profiles.

Key Takeaways

• Janus provides a modular testbed for studying permission management in agentic AI, enabling systematic evaluation of trade-offs between user control and automation efficiency.
• Permission management is a human-computer interaction problem, not just a safety alignment problem—context and user behavior must inform policy design.
• Practitioners should implement granular, configurable permission layers and collect real user interaction data to optimize the autonomy-intervention balance.
• One-size-fits-all permission policies will fail; domain-specific and task-specific profiles are necessary for safe, usable agentic systems.