An AI agent has too many permissions when it can reach a tool, record, or action that its current task does not need. The fix is to enforce limits where actions are executed, not in the prompt. Deny by default, grant narrow read access first, give the agent its own short-lived identity, require approval for consequential operations, and review what it can still do on a schedule. The method below is vendor-neutral and draws on OWASP and NIST publications on AI agent security.
Why capability matters more than the prompt
An agent’s risk comes from two things combined: how the underlying model behaves, and what the surrounding system lets it do. A model can produce an unexpected output, follow an instruction it should have ignored, or misread a request. Whether that becomes an incident depends on the tools attached to it. OWASP’s LLM06:2025 Excessive Agency entry covers excessive functionality, excessive agency, and gaps in downstream user authorization as the conditions that turn a bad output into a real action or a data exposure.
As an Amazon Associate I earn from qualifying purchases.
A system prompt that says “only read customer records” is an instruction to the model. It is not a rule the database enforces. OWASP’s AI Agent Security Cheat Sheet is explicit that prompt instructions do not provide authorization, which is why enforcement has to sit at the tool and downstream-service boundary.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesIndirect prompt injection is the case where the hostile instruction does not come from the person using the agent. It sits inside a web page the agent summarizes, a document it opens, or an email it triages. NIST’s January 2025 technical blog post, Strengthening AI Agent Hijacking Evaluations, describes agent hijacking in which an agent is steered into unintended and potentially harmful actions. The practical consequence is that every piece of content an agent reads is an input that may try to change what it does. Permissions should be sized for the worst instruction the agent might follow, not only for the instruction you intended.
#1 Best Overall
Three ways agents accumulate too much authority
Excessive functionality
A connector often exposes more operations than the task uses. A data connector that can also modify records gives the agent a write path that a reading-and-summarizing job never needs. The agent does not have to misbehave for this to matter: an unused write path is available to any manipulated call that reaches it.
Excessive autonomy
Each tool may be legitimate on its own, yet the combination of broad authority and little oversight lets a single mistaken or manipulated action cause harm. The failure looks normal at the level of each tool call, which is why the review has to focus on what the agent can do in sequence, not only on whether each tool is approved.
Permission scope creep
Temporary or vaguely defined permissions tend to expand over time. A grant added for a one-off migration stays in place because nobody owns its removal. OWASP’s MCP Top 10 project lists permission scope creep among its risks and pairs it with expiration and access reviews.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
No single control is enough
OWASP’s guidance distributes protection across tool selection, permission enforcement, identity, approvals, and downstream authorization. A prompt rule or an approval dialog on its own is not a complete fix. A rule the model can be talked out of, or a confirmation prompt that is clicked through without reading, leaves the execution layer exposed.
The five-step control sequence
Apply these steps in order. Each one narrows what the next step has to protect. The specifics of how a given platform issues scoped tokens or exposes approval hooks vary, so check each step against your platform’s own documentation.
1. Inventory the job
Write down, for each agent:
- The task it performs, in one sentence.
- The data it needs, by system and by record set.
- Every tool it can call.
- Every action each tool exposes, including reads, writes, deletes, sends, and permission changes.
Treat “the tool is available” and “the agent may use this specific action” as two separate decisions. Remove integrations the task does not use and any catch-all function that bundles operations together.
2. Start from deny and add narrow grants
Configure an explicit allowlist of the tools, operations, and resources the task needs. If the task is reading or summarizing, grant read-only access. Scope database access to the required records or operations. Create a separate write identity only when writing is part of the job. Enforce these limits in code or in the service that executes the call.
Free tools Windows power users keep installed
One-click scans. No signup required.
OWASP’s cheat sheet puts the principle in one line: “Grant agents the minimum tools required for their specific task.”
Example: a support-triage agent needs to read tickets in its queue and draft replies. It gets read access to that queue and a draft function. It does not get a send function, and it has no connection to the full customer database. When a human sends a reply, the send happens in the ticketing tool under that person’s own session.
3. Bind access to a person and a task
- Run the agent under a dedicated, attributable service identity, not a developer’s personal credentials.
- Issue short-lived credentials scoped to the task, and let them expire when the task ends.
- Have the downstream system validate the delegated user or session identity, the tenant, and the intended audience of each token, so that a call made for one user cannot act for another.
- Keep long-lived production credentials out of prompts, environment files, and any configuration the agent can read.
The OWASP DevSecOps guideline on AI Agent and MCP Security recommends deny-by-default policy, identity, and scoped tokens as the building blocks for this step. Identity, secrets-management, and privileged-access services are the usual place where teams issue and revoke such credentials.
4. Gate consequential actions
Require action-specific approval before any irreversible, financial, administrative, or externally visible operation. OWASP’s DevSecOps guidance gives examples: pushing code, merging, deploying, deleting data, sending messages, spending money, changing permissions, and contacting a new network destination.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Make approval an execution-time authorization check. The executing service should confirm that a specific, recorded human approval exists for that action and its parameters before it runs. An instruction in the prompt saying “ask before deleting” does not meet this test, because the agent can ignore it and the service has no way to verify it.
Best Value
5. Review and observe
- Keep the permission configuration in version control so that every grant change has a reviewer and a history.
- Give every temporary scope an expiry date, and remove grants the agent has stopped using.
- Review access on a recurring schedule, and assign each grant an owner who answers for it.
- Log every tool call with the identity and scope that authorized it. Without that link, drift is invisible and incident review cannot reconstruct who or what acted.
Where human approval belongs
Two questions decide most cases: is the action hard to reverse, and does it reach beyond the agent’s own workspace? If either answer is yes and the impact is material, put an approval in front of the operation. The table gives a starting default for common action types. These defaults are recommendations derived from the criteria above, not thresholds set by OWASP or NIST, so adjust them to your risk tolerance.
| Action type | Suggested default | Reasoning |
|---|---|---|
| Read or summarize within scoped records | No per-action approval; enforce through a read-only grant | Low impact. The control is the scope, not a human gate. |
| Create an internal draft that is not published or sent | No per-action approval | Easily discarded, so the cost of an error is low. |
| Send a message to an external recipient | Approval required | Externally visible and generally cannot be recalled. |
| Delete or overwrite data | Approval required | Difficult to reverse without backups. |
| Deploy or merge code | Approval required | Affects production behavior and other people’s work. |
| Change permissions or create accounts | Approval required | Administrative, and it can expand future access beyond this task. |
| Spend money or initiate a payment | Approval required | Financial, with direct cost if the action is wrong. |
| Contact a network destination not on the allowlist | Approval required, then add the destination to the allowlist if approved | New external connection, which may carry data out of the environment. |
Choosing between access designs
When you configure access, each decision trades control against operating effort. The table lists the six axes that matter most and the cost of choosing the more restrictive side.
| Decision | More restrictive choice | More permissive choice | Trade-off to accept |
|---|---|---|---|
| Read vs. write | Read-only grant unless writing is required | Read and write on the same identity | Some tasks need a second identity and a handoff step to complete. |
| Broad vs. resource-scoped | Access limited to a defined record set or operation list | Access to the whole system | Scoping requires maintaining the list as records and needs change. |
| Persistent vs. task-scoped | Credentials that expire when the task ends | Credentials that remain valid indefinitely | Short-lived credentials require automated issuance and renewal. |
| Shared vs. dedicated identity | A dedicated agent identity that can be revoked alone | A shared or human identity | More identities to manage, but actions can be attributed and revoked without affecting people. |
| Automatic vs. approval-gated | Approval before consequential actions | Fully automatic execution | Approval adds latency and reviewer load for each gated action. |
| Prompt-only vs. backend-enforced | The execution service checks authorization independently of the model | The agent’s instructions are the only control | Backend enforcement requires engineering work in each tool and service. |
Audit an agent that already has too much access
Use these questions to find over-permissioned agents before an incident does:
- Does any tool expose a write, delete, send, or permission-change operation that the task never calls?
- Does the agent run on a developer’s personal token or on a shared credential?
- Can the agent read any long-lived production secret, from a prompt, an environment file, or its own configuration?
- Can you tell from the logs which identity and scope authorized each tool call?
- Does any grant lack an owner or an expiry date?
- Does any approval exist only in the prompt text rather than in the executing service?
If the answer to any of these is a problem, work through the following steps:
Quick Recap
- Remove write, delete, send, and permission-change grants that the task does not use, and leave read access in place where the task needs it.
- Rotate any long-lived credential the agent could read, and replace it with a short-lived, task-scoped credential.
- Pull the logs for the agent’s identity covering the period when the broad grants existed. List every write-type call and confirm each one was expected.
- Move each remaining consequential operation behind an execution-time approval.
- Record an owner and an expiry date for every remaining grant, and bring the configuration under version control.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
