I Gave My Writer Agent the Keys to the Blog — and Nothing Else

October 28, 2026 · 4 minute read

On a ship, the cook has the key to the galley. Not the magazine, not the chart room, not the captain's safe. The galley. If the cook goes rogue, the worst case is a bad dinner.

This is the single most useful idea I've brought to running a crew of AI agents, and it took me a few months of friction to arrive at it.

The Setup

Troi is my writing agent. She drafts the posts on this site, converts them to HTML, and publishes them. The site itself is plain static files on a cloud server — no CMS, no dashboard, just a folder the web server reads from. Publishing means copying a file into that folder.

For a while, she couldn't.

The folder belonged to another user. Troi's account had no permission to write there, and I don't hand out sudo to agents — I don't have sudo on that machine myself. Riker, my operations lead, set up the infrastructure and keeps the root-level keys. The rest of us are passengers with job titles.

So the workflow was: Troi writes the post, saves the HTML to a staging folder in her own home directory, and then asks one of the systems agents to copy it over. A handoff. A ticket. A little bureaucratic shuffle for every single post, as if the newspaper required the pressman's signature to move an article from the desk to the press.

It worked. It was also stupid, and we all knew it.

The Tempting Wrong Fix

The obvious move is to give her sudo. Problem solved; she can write anywhere.

She can also write anywhere. The agent that drafts blog posts would hold the power to edit system config, read other agents' files, or wipe a directory because a model hallucinated a path. Not because she's malicious — because she's a language model, and language models are confident about filenames in a way that should frighten everyone. A writer with root is a liability with good prose.

The Right Fix Took Twenty Minutes

Riker did three things on the server:

1. Created a web group and put Troi in it.
2. Made the blog directory group-owned by web and group-writable.
3. Set the setgid bit on that directory, so any new file created inside it automatically belongs to the web group too. No orphaned files, no "why can't the web server read this."

Then Troi's publish step became one command: copy the file in, set permissions to 644 so it matches the others. No sudo. No handoff. No asking a crewmate.

The blast radius of a bad day is now: one wrong HTML file in one folder. The galley key.

The One Gotcha

Unix had a parting joke for us. After Riker added her to the group, Troi tried to publish and got Permission denied anyway.

Group membership on Linux is like a gym membership — paying doesn't mean you're inside. Your running session carries the groups you had when you logged in, and the new one doesn't show up until you log out and back in. Her agent session never logs out. The fix is a small command, sg web -c "…", which says "run this one thing as a member of the web group." She wrote that into her own procedures and has used it ever since.

I mention this because it's exactly the kind of thing that makes people give up and reach for sudo. Don't. The error is a door, not a wall.

What Each Agent Can Touch

The pattern now runs across the crew:

• Troi (writer): the web folders. All five sites, nothing else.
• Data, La Forge (systems): the servers, services, and plumbing.
• Riker (ops): the keys, the credentials, the infrastructure.
• Me: no sudo on the cloud box. On purpose. If I need something at root, I ask Riker, same as everyone.

Nobody has more than their job needs. When something breaks, the list of suspects is short.

The Lesson

Least privilege sounds like a security-conference phrase. For a small operator it's simpler than that: it's a budget for how bad a mistake can get. Agents will make mistakes — they're fast, tireless, and periodically very wrong — so you decide in advance how far a wrong move can travel.

The cook gets the galley. The writer gets the blog. The worst case is a bad dinner.

Setting up your own crew? Join The Lookout newsletter — I share the permissions I got wrong before I got them right.

Dave Buster builds with AI agents at AI Quarterdeck. He does not have root on his own server and sleeps better for it.

---