AI agent permissions: least privilege for software that chooses its own actions
A service does what its code says. An agent chooses among the tools it has. That makes the set of tools, and what each one can reach, the real permission boundary.
Permissions are the tools, and what the tools can reach
For an AI agent, a permission is not one IAM role. It is the union of every tool it can call, every MCP server it is connected to, every agent it can delegate to, and every identity those tools act as. Granting a single tool can make a whole chain reachable: a support agent that can call a billing agent can, in effect, issue refunds.
How agent permissions drift
Agent authority rarely grows in one deliberate step. It drifts:
- A tool is added for one task and never removed.
- A dependency update adds tools to an MCP server.
- A delegated agent gains a capability, and every agent that can call it gains it too.
- A permission rule is widened to get unblocked and stays wide.
What least privilege looks like for agents
It starts with an inventory you can trust, then a baseline that someone approved, then a review of every change against it. The question in review is not which files changed but what the agent can now do that it could not do before, directly or through another agent.
How ControlLoop helps
ControlLoop builds an Agent Capability Bill of Materials covering direct and transitive access, compares it with your approved baseline, and blocks material expansion, such as new destructive, financial, or external-communication capability, in CI before it deploys. Evidence reports map what changed and who approved it to SOC 2, ISO/IEC 42001, OWASP, and CSA AI Controls Matrix controls for your auditors.