Problem is striking the right balance, and auto-forwarding your agent to foreign machines is not the right balance. At least not without being able to filter and approve individual signing requests.
It's true in the real world too which is why even in secure buildings a person can often slip in by coat-tailing someone. Stopping every single person to check ID is cumbersome and slows everyone down. People have stuff to do.
Truly high security environments are zero-tolerance, which makes them annoying and expensive to work in. I've talked to people who have worked in US military and CIA/NSA places and a very meaningful amount of time is spent complying with security and jumping through hoops. Even with all that, stuff gets leaked and stolen.
It's not just in computer security, it's in almost everything. People hate friction, but they need it make good decisions.
What we really need is smart people creating well-designed eusocial frictions, rather than trying to mindlessly eliminate friction from all areas. But guess which thing leads to products that can be sold more successfully on the market?
As a user, I would love to get rid of curl | bash and use the OS package manager instead. This would actually be more convenient to me: I wouldn't have to hunt through the documentation to find out what was installed, where it was installed, how I can update it (or does it register its own auto-updater?) and how - or if - I can uninstall it again.
This seems more like a convenience for certain software projects who can't be bothered to interact with distro maintainers and instead want to circumvent the distro system entirely.
Why not at least provide a Debian/Ubuntu and Red Hat package?
Oh boy, it isn't. Friction leads to frustration and therefore more likelihood to ignore the importance altogether.
The classic example is password rotation. It used to be standard to force users to rotate their passwords every 30/90 days, but that led to users having a sticky note on their monitor with their password on it, so security authorities no longer recommend this practice.
Choosing how to sub-divide abilities, and allowing the user to manage that, will be an art unto itself, and depend largely on the system. Thinking a banking API with a rule like "Allow sub user to send payment to water utility once per month, not to exceed $200". The user only needs to intervene if something goes wrong and the amount goes over.
People need to be responsible. They are all lazy. Happy to give away any agency and responsibility to a computer program and scream bloody murder when it goes awry.
People give the keys to their kingdom to some program that will even hallucinate and do all sorts of stuff. WHY. it's stupid. that's not harsh, that's the truth.
Before AI (LLMs), people were much more careful with this sort of stuff, but now they give their keys away to some program which has tons of agency and expect that program to somehow be responsible on their behalf. it's stupid.
Be responsible. LLMs even if tailored truly correctly with all the safety guards can just hallucinate and do shit anyway, so if you don't lock them down, or if you give them your secrets, that _will_ end badly at some point.
Even if hallucinations only happen 0.0001% of the time, that is 1 in 10000, and you do tons and tons of tool calls and model calls even if you only put in 1 prompt, so really, the probability is HIGH.
Sure, the probability of that hallucination also involving a secret is much lower, but it is still HIGH if you consider using LLMs for months or years...
Sure, but in work, friction is not a good thing. So maybe security, if it involves friction, is not a good thing in work? Popularity of npm might be and evidence of that. Distribution system (along in its integration in a myriad of pojects) that's pretty insane from the security stanpoint contributed to so much great stuff and cooperation.
It is indeed a world of reality vs what sounds good on paper.
To have LESS friction you need MORE signals, ones that add up to "this action is low risk, proceed" as a cumulative risk score. Kind of like credit card transactions... most transactions go through silently because the issuer scores them on merchant, amount, device and history, and you only get the step-up prompt when the score is off.
"Manual Approval" and "Bypass Everything" are both what you ship when you have no signals.
In security, friction is a GOOD thing. You want to have some ceremony to do things. It's pretty much inevitable that people will give up control for convenience.
Look at Artifacts for example.