Janus: a Playground for User-Involved Agentic Permission Management
06:00 · July 3, 2026 · arXiv cs.AI RSS
AI agents that autonomously execute tool calls on a user's behalf raise pressing questions about permission management: what role could users play, and what role should they play? Despite many proposed approaches, the user's role in agentic permission management remains under explored. We introduce Janus, a playground system for implementing and evaluating user-involved agentic permission management designs. Janus consists of two components: Janus-Core, a modular agentic system supporting a diverse spectrum of permission management designs, and Janus-Harness, an automated evaluation framework. Grounded in a conceptual model that identifies key design axes for user involvement, we implement six permission assistants spanning the design space and evaluate them across three scenarios and three synthetic responders. We demonstrate that user input is critical and can significantly strengthen privacy and security, that AI augmentation of user decisions can help reduce cognitive load, and that realistic user behavior including permission fatigue must be accounted for in system design. No single design performs optimally across all contexts, motivating a more principled and context-sensitive approach to deploying permission assistants in agentic systems. Janus is publicly available to support future investigation into this dimension of agentic system design.
Summary
Janus is a research playground for exploring how users can participate in runtime permission decisions for AI agents that autonomously invoke tools on their behalf. The system addresses the tension between the principle of complete mediation—every access must be checked—and the practical limits of user attention when agents handle open-ended tasks such as email management that routinely encounter ambiguous or potentially malicious inputs.
The framework consists of two parts. Janus-Core provides a modular agentic architecture that lets researchers plug in different permission assistants along several design axes, including the degree of user involvement, the use of persistent policies versus runtime prompts, and the extent of AI assistance in summarizing or recommending decisions. Janus-Harness supplies an automated evaluation harness that runs controlled experiments across multiple task scenarios and synthetic user responders, allowing repeatable comparison of privacy, security, and usability outcomes.
Using this infrastructure, the authors implemented six distinct permission assistants that cover a range of involvement strategies. Evaluation across three scenarios showed that incorporating user input measurably improves resistance to inappropriate tool calls, while AI augmentation of those decisions can lower cognitive load. At the same time, the experiments confirmed that realistic user behaviors such as permission fatigue quickly degrade the effectiveness of designs that rely on frequent prompts, and that no single configuration performs best in every context.
The work therefore argues for context-sensitive permission systems rather than one-size-fits-all solutions and releases Janus publicly to support further investigation into user-involved agentic security.
Why it matters
This research is highly relevant to the Dutch AI market's strong emphasis on ethical, transparent, and privacy-compliant AI. By providing an open-source framework to test agentic permission management, it offers Dutch researchers and developers practical tools to align autonomous agents with strict EU data protection and AI regulations.
