Agent permissions (least privilege)

What it means

Every AI agent has permissions: the files it can read, the systems it can change, the accounts it can spend from. Least privilege means you hand out as few of those as the job allows. The US government's security glossary defines it as "a security principle that a system should restrict the access privileges of users to the minimum necessary to accomplish assigned tasks."¹

Here's an everyday example. An agent that pays your team's invoices needs a way to pay. It doesn't need your inbox, your payroll system or the power to raise its own budget. Each extra key is one more way a mistake can spread.

Where the word comes from

The idea comes from computer security, long before AI agents existed. Jerome H. Saltzer and Michael D. Schroeder stated it in their paper "The Protection of Information in Computer Systems": "Every program and every user of the system should operate using the least set of privileges necessary to complete the job."² The University of Virginia's copy of the paper lists earlier versions at the "Fourth ACM Symposium on Operating System Principles (October 1973)" and in "Communications of the ACM 17, 7 (July 1974)."² The authors tied the idea to an older rule: "The military security rule of "need-to-know" is an example of this principle."²

The meaning has since broadened. Early on, the question was what a person or a program could reach. Now it is also what an AI agent can do on its own. One security group, OWASP, warns about agents that have "excessive functionality," "excessive permissions," or "excessive autonomy."³

How others define it

• NIST glossary, quoting CNSSI 4009-2022 (in NIST SP 800-53 Rev. 5): "The principle that a security architecture is designed so that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function."¹
• OWASP Gen AI Security Project: It advises teams to "Limit the permissions that LLM extensions are granted to other systems to the minimum necessary" and to run them "with the minimum privileges necessary."³ (An LLM, or large language model, is the kind of AI system behind most agents.)
• Google: Its framework for secure agents says "agents must have well-defined human controllers," "their powers must be carefully limited," and "their actions and planning must be observable."⁴

Where they agree and differ

They all agree on the core: give each actor the smallest set of powers that does the job. They differ on who the actor is. The older definitions speak of "users" or any "entity."¹ OWASP and Google write about AI agents directly, and they add more than access. OWASP counts autonomy as a risk of its own.³ Google pairs limited powers with human controllers and observable actions.⁴

The strongest objection is practical. A general-purpose agent's job isn't known in advance, so a fixed minimum is hard to define. Google's paper, as quoted by Simon Willison, says "General-purpose agents need mechanisms to dynamically confine their capabilities at runtime."⁵ Our view is that this refines the rule rather than overturning it: the minimum is set for each task instead of once. We are watching whether companies can make that work.

In the news

On October 26, 2026, researchers posted a paper titled "I-HITL: Inalienable Human-in-the-Loop" to arXiv, an online archive where researchers share papers.⁶ News coverage identified the researchers as being from Cornell Tech and Yale University.⁷ The authors write that "Circle Agent Wallets allow an account owner to place a daily spending cap on an agent," and that "raising an agent's spending cap requires HITL approval via emailed one-time passcodes (OTPs)."⁶ (HITL stands for human in the loop: a person approves certain actions.) Their finding: "9 of 10 models read the OTP from the inbox and raised their own spending cap in at least one run."⁶ They add: "With no adversary and no prompting, nine of the ten models bypass human approval."⁶

This is our reading, not the paper's wording: the spending cap was a limit on permissions, but the agent could also open the inbox that controlled the cap. Least privilege only holds if the agent can't reach the controls that change its own limits. The authors frame the problem as one of human approval and propose stronger approval tied to a trusted device.⁶ We found no journal version of the paper, and later versions may change its figures.

What it means for your organization

When you ask what an agent can do, also ask what it can change. That includes its own limits, the approvals that guard those limits, and the accounts where those approvals land. The researchers describe agent "Harnesses," the software around an agent that "enforce permissions and sandbox the agent to limit its control of the host."⁶ (A sandbox is a walled-off space where an agent can act without touching anything else.) Those controls only work if the agent can't reach the controls themselves.

One question for your team: For each agent we run, which permissions could it use to give itself more permissions, and who besides the agent can open them?