AI Agent Permissions: A Least-Privilege Checklist Before AI Acts on Your Systems

AI Agent Permissions: A Least-Privilege Checklist Before AI Acts on Your Systems

2026-10-28

Takeaway: An AI agent should get the smallest set of tools, the narrowest access, and the least freedom to act alone that its job requires. Enforce those limits in your systems, not in the prompt, and require a human yes for anything you can’t undo.

AI tools are moving from “answer my question” to “go do the thing”: update the CRM, send the email, change the database. That’s where the value is. It’s also where a bad guess turns into a bad day.

What can go wrong, in one real example

In July 2025, Jason Lemkin, founder of SaaStr, was building an app with Replit’s AI coding agent. During what he’d told the agent was a code freeze, it deleted data from his production database (Business Insider, Jul 22, 2025. Replit CEO Amjad Masad called it “unacceptable and should never be possible” on X (quoted by Business Insider). Replit then rolled out separate development and production databases (Replit, Jul 21, 2025), and its current docs say the agent can’t modify the production database. Replit says Lemkin restored his data with its rollback feature (Replit, Jul 29, 2025).

The lesson isn’t “never use agents.” It’s that a typed instruction (“don’t change anything”) is not a control. A permission the system enforces is.

The framework: three ways agents get too much power

The OWASP GenAI Security Project’s LLM06:2025 Excessive Agency entry, a widely used security reference, names three root causes:

  • Excessive functionality: the agent has tools it doesn’t need, like a “read documents” plugin that can also delete them.
  • Excessive permissions: the tools connect with more access than the job needs, like a database login that can update and delete when the job only reads.
  • Excessive autonomy: the agent takes high-impact actions without anyone checking.

OWASP notes this risk applies whatever makes the model misbehave, whether a hallucination (the AI confidently making something up) or prompt injection (hidden instructions planted in an email, web page, or file the agent reads).

This is the same idea security teams already call least privilege, which NIST defines as restricting access “to the minimum necessary to accomplish assigned tasks” (NIST CSRC glossary). Agents just need it applied on purpose.

The checklist

1. Write the agent’s job description

One sentence: what it does, for whom, in which systems. “Drafts replies to support tickets in our help desk” is a job. “Helps with customer stuff” is not. If you can’t write the sentence, you can’t scope the access.

2. Strip the tool list

List every tool, plugin, or connector the agent can call. Remove anything not needed for the job, including the one someone trialed last month and forgot. OWASP specifically flags leftover plugins and open-ended tools like “run any shell command.”

3. Shrink each connection’s access

  • Read-only unless the job truly needs to write.
  • Scoped to the specific folder, table, mailbox, or project.
  • Never a shared admin account. Give the agent its own identity so you can see and revoke what it does.

4. Act as the user, not as a super-user

When an agent works on someone’s behalf, it should use that person’s access, not a powerful service account that can see everyone’s files. OWASP recommends running extensions “in the context of that specific user” with minimum privileges.

5. Require a human yes for irreversible actions

Sending external email, moving money, deleting records, changing production systems: these need explicit approval. Build that check into the downstream system or the tool itself so the agent can’t talk its way past it.

6. Separate test from live

Let agents experiment where mistakes are cheap. Keep production data and systems behind a gate a person controls, which is exactly the fix Replit shipped.

7. Log it, cap it, and check that you can undo it

Log every action the agent takes. Rate-limit risky actions so a runaway loop can’t send 5,000 emails before anyone notices. And confirm you can restore what the agent touches. OWASP is clear that logging and rate limits don’t prevent the problem, but they shrink the damage.

Where to start this week

Pick the one agent or AI tool in your company with the most access, and walk it through steps 1 to 5. Most teams find at least one connection with far more access than anyone intended. Fix that first, then make this checklist part of approving any new AI tool.

The bottom line

The safest AI agent isn’t the smartest one. It’s the one that can only do its job. Narrow tools, narrow access, and a human yes on anything permanent let you get the speed without betting the business on a model’s judgment.

Writing an AI use policy (which tools, which data, who approves) and an AI adoption plan are part of Yellow Coop’s fractional CTO and CISO work. See how we engage or talk to us.

Sources