Give an AI agent a distinct, accountable identity, only the permissions its job needs, and a constrained environment to work in. Treat it as a bounded collaborator—not as a permanent member with broad access to your organization. “Guest, not a tenant” is a security metaphor, not a formal identity category or universal protocol.
What does it mean to treat an AI agent as a guest?
An agent may read files, use connected applications, send messages, or take actions on a person’s behalf. The security question is not only whether a person approves each action; it is also what the agent is able to reach in the first place. A separately identifiable agent can have permissions assigned to it, activity attributed to it, and access revoked without relying on a human’s shared account.
As an Amazon Associate I earn from qualifying purchases.
Start by defining the agent’s job, then limit its identity, data, tools, and network access to what that job requires. Add human review for consequential actions, but do not make approval prompts the only barrier between an agent and sensitive resources. Access controls, execution boundaries, ownership, monitoring, and a removal path all matter.
Recommended Free Tools
These controls are not a guarantee that an agent will behave safely. They limit the damage it can cause if it is mistaken, misled, or compromised.
#1 Best Overall
Which identity and permissions should an agent use?
Use an identity that makes the agent’s actions attributable and permissions manageable. The exact authorization method depends on the application the agent must access; an “agent identity” does not automatically mean least privilege. An administrator still has to select suitable permissions and confirm that the target application supports the pattern.
Microsoft documents these options for Microsoft Entra, rather than as universal rules for every identity provider or SaaS product:
| Application capability | Documented Microsoft Entra pattern | What to check |
|---|---|---|
| The application supports OAuth permission scopes | Consent an agent identity or service principal to the required scopes. | Grant only the scopes needed for the agent’s defined task. |
| The application recognizes service-principal application roles | Assign the agent identity or service principal to an application role. | Confirm that the role provides the minimum necessary access. |
| A SAML application requires users | Use an agent-user pattern that augments the agent identity with agent users. | Microsoft says to confirm that the application supports this pattern. |
These patterns and their application-specific conditions are described in Microsoft Learn’s guide to assigning agent identities to applications. If an application cannot express suitably narrow permissions, account for that gap rather than assuming the agent’s separate identity solves it.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How should you limit what an agent can reach?
Constrain the agent at the execution boundary as well as in the account it uses. Depending on the product and task, that boundary may be a sandbox, an ephemeral server-side container, or a virtual machine. The aim is to reduce the files, credentials, tools, and network destinations available to the agent—not merely to ask it to avoid using them.
Anthropic describes several different containment approaches across its products. Its local coding sandbox allows reads and workspace writes while denying network access by default; the company says this reduces approval prompts. Its account of Cowork’s VM-based design says the guest sees only selected host-file mounts and that credentials remain in the host keychain rather than inside the guest. These are descriptions of Anthropic’s own systems, not independent validation that the same design is sufficient for every deployment. See Anthropic’s account of how it contains Claude across products.
- Limit files and mounts. Give access to the specific workspace or files needed, rather than a broad view of the host. A mounted workspace can still be damaged by an agent that is compromised or behaves unexpectedly.
- Protect credentials. Avoid placing powerful credentials where the agent can read or transmit them. Review connector access as well as local files; broad connector permissions can expand what the agent can do.
- Control outbound network access. Restrict destinations where feasible, and consider what capabilities an allowed destination exposes. An allowlist alone is not a complete safety boundary.
- Validate filesystem boundaries carefully. Anthropic warns that path checks can be undermined by symlinks if paths are checked before symlink resolution is handled correctly.
Anthropic describes an incident in which a malicious workspace file led an agent to upload files using an attacker-controlled key through a destination permitted by the egress allowlist. The destination was allowed, but its capabilities enabled exfiltration. Anthropic says it mitigated that incident with a proxy that checks for the VM-provisioned session token and rejects attacker-embedded keys. This is the company’s account of its incident and response; it illustrates why destination filtering should be paired with controls on the capabilities available through allowed services.
Approval prompts also have limits. Anthropic reports that users approved roughly 93% of permission prompts in its telemetry, and that permission prompts fell by 84% after it shipped an OS-level sandbox for Claude Code. Both figures are Anthropic’s own product-specific reports from 2026, not industry-wide measurements or independent comparisons. They support a practical caution: repeated clicks can become routine, so reserve human review for actions a person can meaningfully assess and enforce other boundaries in the system.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Should you rely on approvals or environment-based containment?
They address different risks and can be combined. Approval gates ask a person to judge a particular action; containment restricts what resources or capabilities the agent can use, including when a person misses or accepts a prompt inattentively.
| Control | What it limits | What to consider |
|---|---|---|
| Action-by-action approval | Specific actions that trigger a review prompt. | A person may not have enough context to evaluate the request, and frequent prompts can become routine. Use review where the consequence is significant and the action is understandable. |
| Environment-based containment | Reachable files, credentials, tools, and network capabilities. | It can reduce reliance on repeated decisions, but misconfiguration, broad mounts, connectors, or overly capable allowed destinations can leave gaps. |
| Identity and authorization | Which application resources the agent can access under its identity. | Permissions must be selected for the job and supported by the application. A distinct identity alone does not make access narrow. |
| Governance and lifecycle controls | Who owns, monitors, reviews, and can retire the agent. | Runtime controls do not replace inventory, logging, data classification, oversight, or a defined revocation path. |
Anthropic’s engineering article describes its approach this way: “Rather than supervising what the agent does, we supervise what it’s able to do by enforcing access boundaries through, for example, sandboxes, virtual machines, and egress controls.” That is a statement of Anthropic’s design philosophy, not a reason to remove human judgment from high-impact decisions.
What should an organization govern beyond runtime access?
Every deployed agent needs an accountable owner and a lifecycle. Record what it is for, which identity it uses, what data and connectors it can reach, and who can change or revoke its access. Log activity and review it in proportion to the agent’s capabilities and the sensitivity of its data.
- Classify capability and data. A retrieval-only assistant presents a different risk from an agent that completes tasks, automates workflows, uses connectors, or communicates through external channels.
- Keep an inventory. Track deployed agents, owners, permissions, connected services, and the data boundaries they can reach.
- Review sharing and connectors. Check who can use or modify an agent and whether connected services grant more access than its task requires.
- Set lifecycle checkpoints. Define who approves deployment and changes, when access is reviewed, and how the identity, credentials, connectors, and agent itself are retired.
Microsoft Digital describes an enterprise approach that combines embedded governance, IT oversight, and user education, with more advanced governance for tools that complete tasks or automate workflows than for retrieval-only builders. Its account also covers inventory, activity logging, lifecycle management, data classification, and isolation between data boundaries. Microsoft Digital’s Alex Fleck called the company “Customer Zero” in its May 21, 2026 article, describing its experience as a basis for practices to govern agents at scale. This is Microsoft’s named enterprise example, not a requirement to adopt its products or copy its framework exactly. The transferable practices are outlined in Microsoft Digital’s account of governing AI agents at scale.
What should you check when using a cloud agent sandbox?
A sandbox service can provide an isolated runtime, but using one does not transfer every security responsibility to its provider. Alibaba Cloud’s AgentBay security whitepaper describes a shared-responsibility model: the provider secures its platform and isolated runtime, while customers remain responsible for their configurations, data, agent logic, and behavior. The document describes VM-backed and session isolation as vendor-stated features, and recommends least-privilege access policies, credential protection, data classification, and network rules. Review the service’s current controls and your own configuration rather than treating a product label such as “sandbox” as proof of isolation.
For a cloud sandbox, check which files, secrets, and network destinations enter a session; how sessions are isolated and ended; and who is responsible for access policies, data handling, and the agent’s behavior. Alibaba Cloud’s description is available in its AgentBay Security Whitepaper.
How do you turn the idea into a deployment decision?
- Define the task and risk. Specify what the agent may do, what data it needs, and which actions have consequences that warrant human review.
- Choose an attributable identity. Select an identity and authorization method the target application supports; assign only the roles or scopes the task requires.
- Constrain the working environment. Limit file mounts, connectors, credentials, and outbound network access. Check not just which destinations are allowed but what those destinations let the agent do.
- Place human review deliberately. Require approval for consequential actions where a person can assess the request; do not depend on prompts to compensate for broad permissions.
- Assign ownership and a removal path. Inventory the agent, log activity, review its access and data boundaries, and make clear who can revoke its permissions or retire it.
These are complementary controls, not a vendor ranking. The cited Microsoft, Anthropic, and Alibaba Cloud publications describe their own identity, governance, and containment approaches; they do not establish an independent cross-vendor comparison or prove that any single design is sufficient for every organization.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
