Give an AI agent only the data and actions its task requires, and enforce those limits through identity and authorization controls in the systems it connects to—not through a prompt alone. Use a distinct, accountable identity for each agent, separate read access from write or delete access, require approval for consequential actions, and log activity so you can investigate and revoke access when needed.
Start by defining the agent’s task and boundary
Before connecting an agent to a mailbox, file repository, ticketing system, or other business application, write down what it is meant to do and what it must not do. A useful boundary names the business purpose, permitted data locations, allowed operations, accountable owner, and actions that require approval. Those details can then be translated into permissions and tool restrictions.
As an Amazon Associate I earn from qualifying purchases.
- Purpose: State the task in operational terms, such as summarizing messages in a designated mailbox or gathering evidence from approved ticket queues.
- Data scope: Identify the mailboxes, repositories, collections, resource groups, or records the workflow may access.
- Operations: Separate reading, drafting, sending, updating, deleting, and administration. “Access to email” or “access to files” is too broad to be a useful permission definition.
- Owner and approvals: Name the person responsible for the agent and specify which actions need human authorization.
Maintain an inventory of deployed and planned agents that records their purpose, owner, integrations, tools, and effective permissions. Review the combined access an agent obtains across its connectors: individually narrow grants can add up to broad reach when considered together. Microsoft Learn’s guidance on least privilege for AI agents with Microsoft Entra Agent ID, updated July 15, 2026, emphasizes inventory, ownership, scoped roles, auditability, and revocation as parts of that lifecycle.
Use a distinct identity and limit its permissions
An agent should be identifiable as an accountable principal, not hidden behind a shared administrator account or an employee’s broad credentials. Prefer a dedicated managed identity or a user-context authorization flow with only the scope the task needs. This makes it easier to determine which actions came from the agent, review its grants, and remove its access without disrupting unrelated work.
#1 Best Overall
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Set permissions at the narrowest useful level: the relevant resources and the specific operations required. If broader access is occasionally necessary, use approval-based or just-in-time elevation rather than leaving it permanently enabled. Consider the full permission set created by identities, connectors, plugins, downstream APIs, and cross-tenant or guest paths—not just the label on the agent’s primary role.
Separate tools and permissions by action
Tool availability and identity permissions are separate control surfaces. Removing a send tool is useful, but it does not neutralize another tool or API path that can send mail. Conversely, an available tool should still be unable to perform an action that the downstream system denies.
| Workflow | Narrower design | Capability to withhold or gate |
|---|---|---|
| Email summarizer | Read access to the intended mailbox and a mail-reading tool | Sending, forwarding, and deleting; require a person to inspect and send any proposed reply |
| Document summarizer | Retrieval from approved repositories or collections | Access to unrelated repositories and write or delete operations |
| Ticket assistant | Read access for evidence gathering, with a separate limited create or update role if needed | Delete and administrative operations; gate bulk updates |
| Remediation agent | Access limited to named resource groups and services | Execution privilege outside approved, time-limited elevation; require step-up approval for destructive changes |
Prefer purpose-built functions with clear inputs and limited effects over open-ended tools such as a general shell, unrestricted URL fetcher, or broad-purpose extension. Remove tools and plugins the workflow does not use. Where practical, separate evidence gathering from writing so the identity or role used to inspect information cannot also make unreviewed changes.
Recommended Free Tools
Rank #2
- Packing List: This doorbell removal tool set is made of high-quality metal and comes in four types and comes with two doorbell removal pins and a key ring. These kits can be hung on a key ring, making them portable and loss-proof.You will get: 8 x Security Pin Key Release Removal Tool,1 x key ring.
- Anti-slip Handle Design: It has a solid and anti-slip handle, which is easy to grasp and saves effort when using it.
- Wide Application: It could be used for replacing your lost security key to remove your Nest Hello, Arlo and Eufy Video Doorbell from its mount.It can even be used to detach part of the metal watch strap.
- Compatibility: Fits various models of video doorbell. All Arlo Video Doorbell Models, all Eufy Video Doorbell models, and all Nest video doorbell models.
- Multi Usages: With this tool, you could replicate the action of the manufacturer security pin but inserting it on either the top or bottom, dependent on model and pulling gently on the doorbell to release it.
Enforce authorization where the action happens
System prompts can explain the intended task, but they are not an access-control boundary. An agent may misinterpret a request, encounter manipulated content, or invoke a tool in an unexpected way. Check each operation in the target application or service against the actual identity, resource, and requested action. Treat the orchestration layer as one useful control—not the only place that decides whether an operation is allowed.
OWASP’s LLM06:2025 Excessive Agency guidance states: “Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not.” In practical terms, a mail API should reject a send request the agent’s identity is not authorized to make, even if the model or a prompt mistakenly attempts it.
Assume emails and documents can try to manipulate the agent
Content the agent reads is not necessarily trustworthy. A message, document, or other retrieved item can contain instructions designed to induce the agent to use its tools—for example, to search for sensitive messages and forward them. This is an indirect prompt-injection risk: the content is data for the task, not a reliable source of authority to expand the task.
Rank #3
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
Input-handling measures and monitoring can help, but they do not replace narrow permissions. If an agent has no send or delete authority, a malicious message has fewer consequential actions available to exploit. OWASP describes excessive agency in terms of excessive functionality, excessive permissions, or excessive autonomy; reducing each of those independently limits the ways an unexpected instruction can produce harm.
Require approval for consequential actions
Put a human confirmation step in front of operations whose impact warrants independent review: sending or forwarding messages, deleting records, making bulk updates, deploying changes, changing permissions, or carrying out destructive remediation. A draft-and-review workflow is safer than granting a summarizer standing send access. For elevated work, use temporary, approval-based privilege rather than permanent broad access.
Define approval rules with the workflow owner and enforce them in the application or downstream system. A request for confirmation is not a meaningful gate if the agent can bypass it through another tool or credential. Step, iteration, rate, or budget limits can also constrain runaway behavior, but they supplement—not replace—authorization and approval controls.
Rank #4
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
Log enough to investigate and contain activity
Record enough context to reconstruct what happened across the agent and connected systems. Useful fields include the agent identity and owner, role and scope, tool, action, target resource, correlation identifier, and the on-behalf-of user where applicable. Chat transcripts alone may not show which downstream operation occurred or which identity authorized it.
Review records for unexpected resources, operation types, or scope expansion, and revisit permissions when the task, tools, data, or deployment changes. Microsoft’s shared-responsibility guidance for AI agents also makes clear that organizational responsibility for data, identity and credential scope, action authorization, human oversight, and acceptable-use governance does not disappear because an agent is hosted by a provider. Confirm which controls the provider manages and which your organization must configure.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Test revocation and recovery before relying on the agent
Revocation is only effective if it reaches every access path. Rehearse disabling the agent, invalidating tokens, rotating credentials, removing stale assignments, and restoring a known-good configuration. Check for still-valid tokens and downstream grants that remain after the agent itself is disabled. Keep change tracking and rollback procedures for workflows that can alter business systems.
Best Value
- Protect accounts with USB-A & NFC 2FA security key. Hardware-based authentication blocks phishing, credential theft & unauthorized access across cloud, enterprise & personal platforms.
- FIDO2 Level 2 certified Security Key. TAA compliant and supports Apple ID, Microsoft Azure/Entra ID, AWS, Google, Facebook, Salesforce, DUO & more. Works with Chrome, Safari & Edge across major OS.
- Plug & play USB-A Security Key with NFC tap login. No software, drivers or batteries required. Works with Windows PC, MacBook, iPhone, Android & Chromebook for fast, secure authentication.
- Built with FIPS 140-2 Level 3 secure element for advanced encryption. Trusted by IT teams, healthcare, education & government for secure authentication and identity protection.
- IP68 waterproof, dustproof & crush-resistant design. Supports FIDO2, U2F, OTP, PIV, Mini Driver & smart card login. Durable USB security key for long-term enterprise and daily use.
These controls have operational costs: scoped roles and allowlists require upfront design, identity lifecycle and access reviews require ongoing attention, and approval gates can slow privileged workflows. Those are trade-offs to plan for, not reasons to substitute a prompt instruction for enforceable limits.
Compare the control design, not just the connector
When evaluating an agent architecture or integration, ask where authority comes from and where it is checked. A connector that looks convenient may still rely on a broad credential or leave the downstream system unable to distinguish the agent’s permitted actions.
| Control question | Stronger design | Weaker design |
|---|---|---|
| Identity | Unique, owned agent principal | Shared user or service credentials |
| Authorization context | User-delegated or task-specific scope | Broad standing permissions |
| Granularity | Separate read, write, delete, and resource-level controls | All-or-nothing connector access |
| Enforcement point | Authorization checks in each downstream system | Prompt-only or orchestrator-only restrictions |
| Approval and elevation | Action-specific approval or temporary elevation | Always-on write or administrative access |
| Observability and containment | Action-level logs, correlation, ownership, and tested revocation | Visibility limited to chat transcripts |
| Deployment responsibility | Clear understanding of provider-managed and customer-configured controls | Assuming the provider manages all identity, scope, audit, and approval settings |
The same checks apply to regulated-data workflows: require explicit access approval, stronger audit and retention practices appropriate to the data, and confirmation that the downstream application—not only the agent orchestrator—enforces the intended boundary.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
