datasette-agent 0.1a2

The more consequential detail here isn't the permission model itself but the timing: this credential-scoping pattern was established in 0.1a2 before the charts plugin even shipped, meaning the authorization architecture was deliberately laid as a foundation rather than retrofitted after the fact.

That sequencing becomes visible when you look at the subsequent datasette-agent-charts releases. The 0.1a1 charts release (covered here just days later) explicitly included permission-aware SQL execution, which would have been significantly harder to bolt on without the credential scaffolding this update established. Then datasette-agent-charts 0.1a2 added query transparency so users can audit what the agent actually ran, a feature that only makes sense in a system where access boundaries are already defined. Taken together, these three releases read less like independent updates and more like a deliberate layered build: auth first, capability second, auditability third. That sequencing mirrors what OpenAI is doing with Codex goal mode, where sustained autonomous operation requires trust infrastructure before expanded capability is viable.

Watch whether datasette-agent introduces role-differentiated permission tiers (beyond the current background credential) within the next two release cycles. If it does, that confirms Willison is building toward multi-agent or multi-user deployments rather than single-operator tooling.