Control · C-024 · Security & Resilience

Least-privilege agent identity and permissions

Each agent has its own identity, with permissions scoped to its task and to the user it is acting for, short-lived and reviewed like any other entitlement.

Control type: Preventive
Family: 10 Security & Resilience
Risks addressed: 9
Audience: Heads-of · Practitioner
Frameworks: AML.M0026 · AML.M0028 · ASI03
Responsible AI domain: 10 Security & Resilience
Lifecycle stage: 3 Design & build
6 Deploy
7 Operate & monitor
Reviewed: 2026-11-10

What it does

It bounds what an agent can do, whatever it is induced to attempt, and it makes every action attributable to a specific agent acting for a specific person. The identity and access management function owns the standard and each agent's owner answers for its entitlements, which are granted at deployment and reviewed on the same cycle as those of staff.

How to implement it

Register each agent as a distinct identity; never run one under a person's or a shared account.
Grant permissions per tool operation, not per system.
Where the agent acts for a user, limit it to what that user may do.
Issue short-lived credentials at run time and do not let the agent read them.
Do not pass a calling agent's full authority to a sub-agent.
Include agents in periodic entitlement reviews and remove unused permissions.

Evidence it operates

Design: the identity inventory lists every agent, with an owner and its entitlements. Operation: access logs show agent actions under agent identities; the latest entitlement review covers agents and records removals; a test request made for a low-privilege user is refused data that user may not see.

Where it fits

Established at design and at deployment, maintained in operation. It is the foundation for approval gates and agent sandboxing and isolation, which assume the agent cannot exceed its grant.

Limits

It does not stop harmful use of a permission the agent properly holds. Fine-grained permissions need tools designed to support them; a tool that exposes one broad operation cannot be scoped.

Risks this mitigates

Primary mappings

Agent identity and privilege abuse High: Gives each agent its own identity with short-lived, task-scoped permissions. An agent inherits, shares or escalates credentials and delegated authority beyond what its task needs, so a compromise or error acts with far wider access than intended.
Agent tool misuse High: Scopes each tool permission to the task. An agent uses a tool it is permitted to use in an unsafe or unintended way, such as a destructive command or a wrong parameter, causing data loss, unauthorised transactions or disruption.
Excessive agency in autonomous agents High: Limits the agent's permissions to what the task needs. An agent is given more functions, permissions or independence than its task requires, so an error, an ambiguous instruction or a manipulated input turns into a damaging action that no one approved.
Insecure inter-agent communication Medium: Authenticates each agent and authorises what it may ask of others. Messages between agents are not authenticated, authorised or validated, so one compromised or spoofed agent can instruct the others.
Over-privileged agent skills and tools Medium: Grants a skill only the access its function needs. Reusable skills and tool definitions request broader permissions than their function needs and run without isolation, enlarging the effect of any misuse.

Supporting mappings

Agent goal hijack High: Limits what a hijacked agent can reach. Injected or poisoned content redirects an agent's objective or plan, so the agent pursues an attacker's goal with the organisation's authority and access.
Exposed AI credentials and secrets High: Short-lived, narrowly scoped credentials limit what an exposed secret can do. API keys, tokens and connection secrets sit in prompts, agent configuration, notebooks or logs, where the model or an attacker can read and reuse them.
Rogue agent behaviour High: Limits the harm a deviating agent can do. An agent departs from its intended function or acts deceptively or outside its mandate, through misaligned objectives, emergent behaviour or a compromise that persists, while each action appears legitimate.
Unexpected code execution by agents Critical: Limits the privileges the code runs with. An agent generates and runs code or commands that were never reviewed, allowing injected instructions or model error to execute on the host or in connected systems.

Framework and clause references

Framework	Clause	Title
MITRE ATLAS	AML.M0026	Manage AI Agent Service Access Privileged agent permissions.
MITRE ATLAS	AML.M0028	Enforce Access Controls for AI Agent Tools Tool permissions.
OWASP Top 10 for Agentic Applications	ASI03	Identity and Privilege Abuse The risk this control answers.

Related terms

How to cite

Axiom Verity (2026). Least-privilege agent identity and permissions. Reference Library, C-024. https://axiom-verity.com/controls/least-privilege-agent-identity. Reviewed 2026-11-10.

Found an error or a better source? Report a correction.