Give an AI agent its own accountable identity, allow only the tools and data required for its task, and enforce authorization every time it acts. Add fresh human approval for consequential operations, isolate memory and retrieved data, and log and test how access is revoked. A prompt telling an agent to “be careful” is not an access control.
Start with a dedicated, accountable identity
An agent should not operate through an untracked shared administrator account or a developer’s standing credentials. Give each agent a dedicated identity, assign an owner or sponsor, and document its purpose, runtime, approved data, tools, and downstream systems. Microsoft’s guidance on least privilege for AI agents recommends reviewing the identity’s effective permissions across connected roles and systems, not just the permissions visible in the agent configuration.
As an Amazon Associate I earn from qualifying purchases.
Where the architecture supports it, bind the agent’s authority to the user who initiated a task or to an approved workload identity. This helps preserve the distinction between what the user is allowed to do and what the agent’s service identity can do. If a user-delegated design is unavailable, keep the service identity’s permissions narrowly scoped rather than treating its broader access as permission for every user request.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Inventory the agent’s owner, purpose, runtime, data stores, connectors, tools, downstream systems, and external communication paths.
- Require review before enabling an integration; deny unreviewed connections by default.
- Record who is accountable for approving access and responding when the agent behaves unexpectedly.
Limit tools, actions, and resources separately
“Can use the CRM” or “can access company files” is usually too broad to be a useful permission. Define an allowlist that says which tool the agent may call, which operations it may perform, and which records or resources those operations may target. Default to read-only access where that is sufficient; grant write access only for operations the workflow actually needs.
#1 Best Overall
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
OWASP’s AI Agent Security Cheat Sheet recommends minimizing the tool set and explicitly scoping permissions. Microsoft’s AI agent shared-responsibility guidance likewise emphasizes least privilege for each tool. These controls should be enforced by the system that brokers or executes the tool call, not by relying on the model to follow an instruction in its prompt.
| Workflow need | Safer permission shape | Boundary to enforce |
|---|---|---|
| Find information | Read-only access to the specific approved data source or records | Check the user, tenant, and resource on each retrieval |
| Prepare a change | Read access plus permission to create a draft, not publish or send it | Keep the final external action behind an approval step |
| Update a record | Write permission limited to the required fields and record scope | Reject calls that target another record, field, or tenant |
| Administrative or production operation | Just-in-time, task-specific privilege rather than standing broad access | Require a separate authorization decision and, where consequential, fresh human approval |
Authorize each action when it happens
A check at the beginning of a chat or workflow does not establish that every later tool call is allowed. The agent may retrieve new data, choose a different target, or reach a higher-impact operation as the task unfolds. Before execution, check the identity, requested action, exact target resource, current policy, and relevant user or workload context. Deny the call if the check fails; do not let the model’s explanation substitute for authorization.
Prefer scoped, short-lived credentials over long-lived tokens with broad access. Use just-in-time privilege for exceptional operations, and verify that expiry, token invalidation, and permission removal have the intended effect in the systems the agent can reach. Microsoft’s identity and least-privilege guidance describes scoped short-lived tokens and fresh approval for consequential operations.
Recommended Free Tools
Rank #2
- Supports FIDO2 biometric authentication services and FIDO U2F services requiring security key functionality. Secure and flexible authentication across multiple platforms.
- Exceptional biometric performance, 360° readability, and advanced anti-spoofing technology.
- Designed for portability, it comes with a cover to protect the security key when not in use.
- Aligns with cybersecurity measures that comply with key privacy laws and regulations, including GDPR, BIPA, and CCPA. Approved for use in U.S. federal government institutions.
- Passkey compatibility with Microsoft, Google, and Apple for a convenient and secure sign-in experience. Certified for Microsoft Entra ID for secure multifactor integration with Microsoft services.
Put human approval at consequential boundaries
Require a fresh, explicit decision before the agent performs an irreversible, financial, administrative, production, or externally visible operation. Examples include sending a message to customers, deleting records, issuing a payment, deploying a change, or modifying permissions. Approval should apply to the specific proposed action and target, not serve as blanket permission for the rest of a session.
Where feasible, let the agent prepare a draft or proposed change, then have the authorized person review and approve it before execution. Record the proposed action, approver, decision, and resulting operation in the audit trail. This separates assistance from authority: the agent can help assemble work without being allowed to finalize every consequential step.
Treat retrieved data and memory as part of the access boundary
Data does not stop being sensitive when it is copied from a source system into a prompt, retrieved context, cache, or persistent memory. Apply access controls to these copies as well as to the original system. Isolate memory by user and tenant, limit what the agent retains to what the task needs, and define retention and deletion rules.
Rank #3
![Thetis Pro FIDO2 Security Key Passkey with Complex Pin [PinPlex], Hardware Device Supports USB A, Type C &NFC, TOTP/HOTP Authenticator APP, PIV Certificates, FIDO 2.0 Two Factor Authentication 2FA MFA](https://m.media-amazon.com/images/I/31ugrBqG6SL._SL160_.jpg)
- Dual USB-A and USB-C Security Key – Features both USB-A and USB-C connectors for seamless compatibility across desktops, laptops, and tablets. Supports plug-and-stay use or keychain carry.
- NFC-Enabled for Mobile Access – Built-in NFC allows fast, wireless authentication with Android and iPhone devices. Ideal for mobile logins and on-the-go security.
- FIDO Certified for Strong Authentication – [CHECK COMPATIBILITY before purchase] Fully compliant with FIDO2 and FIDO U2F standards. Works with major platforms like Google, Microsoft, GitHub, and Dropbox.
- Passwordless Login with PinPlex – Supports secure passkey login via WebAuthn and CTAP2 with added protection from PinPlex, a complex PIN system that enhances physical security.
- Multi-Layer Authentication Support – Includes PIV certificates and supports both TOTP and HOTP for strong 2FA/MFA coverage across enterprise and consumer apps.
For every retrieval or memory lookup, preserve the relevant user and tenant boundary and check access to the underlying information. Avoid carrying one user’s context into another user’s session. When an agent passes data to a tool, apply the same sensitivity and destination checks that would apply to a direct user operation. Microsoft’s shared-responsibility guidance identifies memory isolation and access controls as part of securing an agent.
Constrain execution and external connections
Separate tools by trust level so that access to a low-risk read operation does not automatically enable a high-impact write or administrative operation. Run code or other untrusted execution in an appropriately isolated environment, and restrict outbound network paths where the workflow does not need them. These controls reduce the chance that an agent can use an allowed tool or exposed data to reach unrelated systems.
Microsoft’s shared-responsibility guidance discusses sandboxing and egress controls, while AWS Prescriptive Guidance on enterprise agentic AI covers secure tool execution and knowledge-base access controls. The precise design depends on the runtime and connected systems: validate enforcement at the actual execution and data-access points rather than assuming that a platform setting controls every downstream service.
Rank #4
- Cybersecurity Analyst KEYCHAIN - It is made of high quality stainless steel. Elegant and durable black stainless steel keychain with a sleek finish
- Cybersecurity Analyst Keyring Can be customized with personal engraving for a unique and sentimental gift
- Cybersecurity Analyst GIFT - Versatile and suitable for any occasion, such as birthdays, anniversaries, graduations, and more
- BLACK COLOR - This funny sarcasm gift keychain features a black color that will complement any outfit or bag.
- Compact size (4 x 2.2 cm) makes it easy to carry on keys, bags, or luggage. A perfect combination of practicality and personal touch that is sure to impress.
Make access visible, reviewable, and revocable
Log enough context to reconstruct what the agent was permitted to do and what it actually did. Useful fields include the agent identity, effective scope, tool and action, target resource, authorization decision, correlation context, and any human approval. Monitor for unusual access patterns and connect the records to the organization’s existing security operations where possible.
Revocation is only reliable if it cuts off every path the agent can use. Test disabling the agent, rotating its credentials, invalidating active tokens, and removing permissions; verify access is denied in connected systems, not only in the agent interface. Microsoft recommends logging, testing revocation, and reviewing access after material changes.
Free tools Windows power users keep installed
One-click scans. No signup required.
Re-review permissions when the model, prompt or workflow, tools, data scope, or deployment environment changes materially. A change that seems like a prompt update can alter which tools the agent selects or what data it needs, so access should be checked against the new behavior and approved purpose.
Use this sequence when deploying or tightening an agent
- Map the boundary: list the owner, purpose, runtime, data stores, connectors, tools, downstream systems, and external communication paths.
- Establish identity: assign a dedicated, accountable agent identity and bind it to an initiating user or approved workload identity when supported.
- Write the allowlist: specify permitted tools, actions, resources, and data scopes; make access read-only unless the task needs a defined write operation.
- Enforce at execution: use short-lived scoped credentials and check authorization against the exact action and target every time the agent calls a tool.
- Gate high-impact actions: require fresh approval before irreversible, financial, administrative, production, or externally visible operations.
- Protect context: isolate retrieved data and memory by user and tenant, and set retention and deletion rules.
- Instrument and test: log decisions and actions, monitor activity, and verify that revocation and incident-response procedures work across connected systems.
- Reassess after change: review access whenever the model, workflow, tools, data, or deployment changes materially.
Compare implementations by enforcement, not product claims
When evaluating an architecture or vendor, compare whether it delegates access from a user or assigns a service identity; how finely it scopes permissions across tools, actions, and resources; how credential expiry and revocation behave; and whether it rechecks authorization on every action. Also assess approval controls, tenant and memory isolation, audit completeness, and integration with existing identity and security operations.
Microsoft Entra ID is an example in Microsoft’s guidance, not a universal recommendation. The cited guidance provides implementation practices, not a jurisdiction-specific legal determination or proof that a product is secure by default. Validate effective permissions, downstream enforcement, and revocation behavior in the environment where the agent will run.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
