--- title: "AI agent permissions and least privilege - actionlake" description: "AI agent permissions decide which systems and actions an agent's credential may reach. How to apply least privilege to agents, enforced outside the model." canonical: https://actionlake.com/glossary/ai-agent-permissions updated: 2026-10-22 --- Control and proof # AI agent permissions (least privilege) AI agent permissions are the rules that decide which systems, actions and data an agent's credential may reach, and least privilege for agents means granting only the actions a task needs and enforcing that limit outside the model. Updated 22 October 2026 Also called Least privilege for AI agents, Agent authorisation, Agent scopes 4 sources checked **On this page** Connect an agent to every system you run. 100,000 calls free a month. No card. [Start free](https://actionlake.com/console?start=sandbox) ## What it is Least privilege is an old security principle. NIST's glossary defines it as restricting the access privileges of users, or processes acting on their behalf, to the minimum necessary to do their work. An AI agent is exactly such a process. Agent permissions apply the principle per agent: this key may read tickets and create them in one PSA; that key may only read invoices. ## Why it matters A model can be wrong, and it can be manipulated through [prompt injection](https://actionlake.com/glossary/prompt-injection). Permissions decide how much damage either can do. The OWASP Top 10 for LLM applications lists **excessive permissions** as a root cause of excessive agency, and recommends limiting what extensions may do in other systems to the minimum necessary. OWASP's agent cheat sheet adds two rules: scope permissions per tool (read-only versus write, specific resources), and fail closed for unknown tools. ## How it works 1. **One credential per agent**, so each can be limited and revoked on its own. 2. **A scope** listing what the credential may run: whole services, single actions, or classes such as read-only. 3. **Enforcement where the call executes**, not in the model's instructions. OWASP's prompt-injection cheat sheet warns against treating prompt wording as an enforcement boundary. 4. **Narrowing only.** A credential that creates another can grant at most what it holds. 5. **Revocation** that stops the agent at once. ## Example A ticket-triage agent gets a key that allows `read:*` plus `service.ticket.create` on the PSA. It can read every connected system and open tickets. It cannot close tickets, edit invoices or delete anything, whatever its prompt says. ## Common pitfalls - **One shared admin token** for every agent: no least privilege and no way to tell agents apart. - **Vendor scopes that are too coarse.** Many OAuth scopes grant read and write together; the limit has to be applied above them. - **Rules written into the system prompt** instead of checked by the server. - **Forgetting administration.** An agent that can create connections or keys can widen its own reach. ## How actionlake handles it Every actionlake key carries `allowed_actions`. An entry may name one action, a [canonical verb](https://actionlake.com/glossary/canonical-verb) such as `service.ticket.create`, a whole service (`xero.*`), an effect class (`read:*`), an effect class on one service, or everything (`*`). An empty list allows nothing. The check runs before any cost is incurred. A key can mint keys only within its own scope, and revoking a key revokes every key it minted. Changing connections, credentials or keys needs a separate `account:*` grant that `*` does not include, and deciding approvals needs `approve:*`. Pair scopes with [caps](https://actionlake.com/glossary/agent-spending-cap) and [approval rules](https://actionlake.com/glossary/human-in-the-loop-approval). Details are on the [trust page](https://actionlake.com/trust). ## Questions **What does least privilege mean for an AI agent?** Give each agent its own credential that can run only the actions its task needs, enforce the limit on the server that executes calls, and let it create only narrower credentials. **Can I make an AI agent read-only?** Yes, if the platform enforces it per call. A read-only scope must be checked where the action runs; telling the model not to write is not a control. **Are OAuth scopes enough to limit an agent?** Often not. Vendor scopes are usually coarse, granting read and write to a whole area. Agent permissions add a finer limit per action on top of the vendor's scope. ## Related terms - [Human-in-the-loop approval Human-in-the-loop approval is a control that pauses an AI agent's action until a named person approves or rejects it, so high-impact or irreversible actions never run on the model's judgement alone.](https://actionlake.com/glossary/human-in-the-loop-approval) - [Agent spending cap An agent spending cap is a hard limit on how much a single AI agent credential may spend or call in a period, checked before each request is sent, so that a looping or misbehaving agent stops at the limit instead of after it.](https://actionlake.com/glossary/agent-spending-cap) - [Prompt injection Prompt injection is an attack in which text that a language model reads, typed by a user or hidden in a web page, email, document or tool result, changes the model's behaviour, and in a tool-using agent it can turn into real actions.](https://actionlake.com/glossary/prompt-injection) - [Credential vault A credential vault for AI agents stores the API keys and OAuth tokens for business systems encrypted outside the agent, and uses them on the agent's behalf only at the moment of each call, so the model, its prompt and its logs never contain a vendor secret.](https://actionlake.com/glossary/credential-vault) - [Canonical verb A canonical verb is one standard name for the same operation across every system that supports it, written domain.object.operation, such as service.ticket.create, so an agent learns an action once and can run it against any connected system.](https://actionlake.com/glossary/canonical-verb) - [OAuth for MCP OAuth for MCP is the authorisation flow the MCP specification defines for remote servers, in which an MCP client discovers the server's authorisation server, registers itself, sends the person to sign in and consent, and then calls the server with a short-lived, audience-bound access token.](https://actionlake.com/glossary/oauth-dynamic-client-registration) ## Sources 1. [Glossary: least privilege](https://csrc.nist.gov/glossary/term/least_privilege) NIST Computer Security Resource Center · checked 22 October 2026 2. [LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) OWASP Gen AI Security Project · checked 22 October 2026 3. [AI Agent Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html) OWASP Cheat Sheet Series · checked 22 October 2026 4. [LLM Prompt Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html) OWASP Cheat Sheet Series · checked 22 October 2026 [All 30 glossary terms](https://actionlake.com/glossary) ## Connect an agent. Start free. [Start free](https://actionlake.com/console?start=sandbox) [Read the quickstart](https://actionlake.com/docs/quickstart) 100,000 calls free every month. No card. Hard caps on every key. --- Source: https://actionlake.com/glossary/ai-agent-permissions More: https://actionlake.com/llms.txt