---
title: "Comment by Kartik N V J K on \"What DVAA Teaches About AI Agent Permissions\" | Hashnode"
description: "DVAA is a good teaching tool because permission scoping is where most agent security actually lives, and over-broad tool access is the vulnerability people noti"
url: "https://hashnode.com/posts/what-dvaa-teaches-about-ai-agent-permissions/6a8450aa1ae57ca75a99f31c/comment/6a85fd8471e234059a23e57f"
---

[Discussion](https://hashnode.com/posts/what-dvaa-teaches-about-ai-agent-permissions/6a8450aa1ae57ca75a99f31c)

Comment [What DVAA Teaches About AI Agent Permissions](https://hashnode.com/posts/what-dvaa-teaches-about-ai-agent-permissions/6a8450aa1ae57ca75a99f31c)

[Kartik N V J K](https://hashnode.com/@kartik-nvj)

[Aug 19](https://hashnode.com/posts/what-dvaa-teaches-about-ai-agent-permissions/6a8450aa1ae57ca75a99f31c/comment/6a85fd8471e234059a23e57f)

DVAA is a good teaching tool because permission scoping is where most agent security actually lives, and over-broad tool access is the vulnerability people notice last. The habit that helped me was treating every tool grant as something the agent has to earn per task, not a standing capability. Did working through DVAA change how you scope tool access by default?