Yes—but only when an agent’s identity, permissions, data boundaries and actions are controlled outside the model itself. Prompts can guide an agent; they cannot securely decide what company data it is allowed to access. Treat each agent as a privileged software identity, grant only task-specific access, and require human approval when an action could have significant consequences.
What makes company-data access safe?
Safety depends on controls around the agent and the systems it can reach, not on whether its answers seem sensible. An agent may retrieve documents, invoke tools and pass information to downstream services. Each connection is another place where access must be limited and checked.
As an Amazon Associate I earn from qualifying purchases.
Microsoft’s guidance on agent identities and autonomous systems emphasizes dedicated identities, least privilege, deterministic authorization, oversight and monitoring. In practical terms, a safe design should be able to answer three questions at every step: which identity is acting, which resource may it access, and which action may it take?
Free tools Windows power users keep installed
One-click scans. No signup required.
- Identity: Give the agent a distinct, accountable identity rather than relying on an informal shared credential.
- Scope: Limit access to the data, tools and operations required for its defined task.
- Enforcement: Check permissions in the application, connector or downstream service each time access is requested.
- Oversight: Make consequential actions visible, reviewable and interruptible.
- Operations: Log activity, monitor for problems and be able to revoke access quickly.
Should an agent use my permissions or its own identity?
Choose the authority that matches the work. If an agent is helping a person with that person’s company data, delegated authorization—such as OAuth on-behalf-of access—can keep the agent within the user’s permissions. For scheduled or background work authorized by the application, a distinct agent or workload identity may be more appropriate.
#1 Best Overall
A workflow can use both. For example, it might access a user’s documents with delegated authority while using the agent’s own identity for workflow state or telemetry. Decide whose authority permits each action, and make the downstream system enforce that decision; do not assume the identity used for one step automatically authorizes another.
Shared resources and multiple tenants
For systems serving multiple customers or business units, possible approaches include a shared identity with deterministic tenant-aware filtering, separate identities restricted to individual data partitions, or delegated user access. A shared identity can be simpler to operate but makes reliable filtering essential. Partition-specific identities can improve isolation while adding credential and lifecycle management. Select an approach based on data sensitivity, isolation requirements and the organization’s ability to operate it safely.
Can prompts stop an agent from accessing the wrong data?
No. Instructions such as “only use this customer’s records” are not an authorization boundary. Microsoft’s Azure Architecture Center explicitly warns against relying on prompts, system instructions or model behavior for tenant isolation. Tenant context, resource access and tool permissions need to be enforced in deterministic code and policy.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
Authorization should be evaluated whenever a tool is invoked, rather than inferred from an earlier step in the conversation or workflow. Do not let the model set or change tenant identifiers, and do not make the model the sole carrier of a user’s identity or authorization context.
What if a document or tool result contains malicious instructions?
Retrieved material is data, not trusted instruction. A document, email, webpage, tool response or other input may contain text designed to manipulate the agent into revealing information or taking an unauthorized action. This is commonly called indirect prompt injection.
- Keep trusted instructions separate from retrieved content, memory and tool parameters.
- Validate tool names, arguments, resource identifiers and requested operations in deterministic code.
- Allowlist only the tools and operations needed for the task; deny unreviewed integrations by default.
- Test whether hostile or misleading content can cause unsafe tool selection, cross-tenant access or data leakage.
- Use content filters as one layer of defense, not as a replacement for access checks.
Microsoft’s guidance recommends layered safeguards and adversarial testing. Testing should be repeated when prompts, models, tools, data sources or workflows change materially, because a change can alter how the agent behaves or what it can reach.
How much access should an agent have?
Apply least privilege and least action: grant only the permissions, resources and operations needed for the stated task. Review effective permissions across the whole chain—from orchestrator to connector, tool and downstream service—not just the first integration screen. Prefer short-lived or just-in-time elevation for exceptional privileged work over standing broad access.
Before connecting an agent, document its owner, purpose, operating environment, data sources, tools, plugins, downstream services and whether it acts for a user or in the background. Keep an inventory and revisit it when the agent’s data or workflow changes. At each handoff, check that the identity, role and scope still authorize the requested operation.
When should a person approve an action?
Human approval is useful when an action could have a significant effect—for example, a financial transaction, an administrative change, a customer-record modification or an action affecting an external system. Give reviewers enough visibility into the proposed action and relevant tool use to assess it, and provide a way to interrupt or investigate the workflow.
Approval is an added safeguard, not permission in itself. The system must still verify that the identity is authorized to perform the action and that the target resource is within scope.
What should be logged, monitored and tested?
Logs should make it possible to trace what happened and under whose authority without giving every operator access to sensitive content. Record the agent identity and owner, effective scope, tool and action, target resource, correlation information, and the user on whose behalf the agent acted where applicable. Restrict access to logs and traces: they may contain prompts, inputs, outputs or proprietary information.
Recommended Free Tools
Plan for revocation and rehearse it. A response should be able to disable the agent, rotate credentials, invalidate tokens and remove stale permissions. Establish monitoring and a safe shutdown path before broad deployment, not after an incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Who is responsible with SaaS, a managed platform or self-hosting?
Responsibility changes with the deployment, but it does not disappear when a provider operates the software. Microsoft’s shared-responsibility model is illustrative rather than a universal contract rule; the applicable service agreement determines each provider’s commitments.
| Deployment | Provider typically operates | Customer still needs to govern |
|---|---|---|
| SaaS agent | The provider may operate orchestration, the model, safety systems and most connectors. | Data scope, identity, configuration and how the agent is used. |
| Managed agent platform | The provider supplies the runtime and platform controls. | More of the agent’s instructions, tools, permissions, orchestration, memory, identity and authorization. |
| Self-hosted IaaS agent | The infrastructure provider supplies underlying infrastructure. | More of the agent stack, including its operation and security controls. |
For any option, establish who operates the orchestrator, runtime, model and connectors; who configures identity and per-action permissions; whether tenant boundaries are enforced downstream; how memory, logs and generated artifacts are isolated; and whether high-impact actions can be approved, interrupted and audited. Customers remain accountable for their data, credentials, authorized actions, oversight and governance.
Is there a certification that proves an agent is safe?
The cited guidance does not establish a universal certification or threshold that proves an agent is safe for every company and use case. Validation needs to reflect the systems and actions the agent can reach: scoped identity, deterministic authorization, isolation, adversarial testing, monitoring and rehearsed revocation are more useful evidence than a model’s apparent reliability in conversation.
NIST NCCoE’s February 2026 concept paper, Accelerating the Adoption of Software and AI Agent Identity and Authorization, frames open project questions about strong agent authentication, zero-trust authorization, least privilege for unpredictable actions, binding agent and human identity for approvals, and verifiable audit records. It is a concept paper for planned work, not a finalized control standard.
Quick Recap
Pre-connection checklist
- Name an owner: Document the agent’s purpose, operating mode, data sources, tools and downstream services.
- Choose an identity: Decide whether each action should use delegated user authority, an agent identity or a deliberate combination.
- Limit access: Scope permissions to specific resources and actions; allowlist tools and operations.
- Enforce boundaries: Check authorization and tenant context in deterministic systems on every tool invocation.
- Handle untrusted content: Separate data from instructions, validate parameters and test for injection and leakage.
- Gate consequential actions: Add human review where the impact warrants it, without substituting approval for authorization.
- Prepare operations: Restrict logs, monitor activity, test revocation and define a safe shutdown path.
- Reassess changes: Repeat relevant security testing when the model, prompts, tools, data or workflow changes materially.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
