AI agents become materially riskier when they move from generating text to taking actions. The central security question is no longer only what the model can say, but what credentials, data and tools it can use.

Give the agent a role, not a master key

Create identities for agent workloads and grant only the permissions required for defined tasks. Avoid sharing broad human administrator credentials. Scope access by application, dataset, action and environment. Separate read from write. Reading a customer record and changing it are different capabilities. Keep them distinct so workflows can remain useful even when write access requires additional approval.

Use transaction boundaries.

For financial, operational or customer-facing actions, impose limits on value, frequency and affected records. High-impact actions can require human confirmation or deterministic policy checks. Protect against indirect instructions. Agents may read emails, documents or web pages containing malicious instructions. Treat retrieved content as data rather than trusted commands. Tool authorization should come from the system policy, not from text encountered during a task.

Log decisions and tool calls

Audit trails should capture which agent identity acted, which user initiated the task, what tool was called, what arguments were supplied and whether approval occurred. This complements the monitoring practices in our AI agent observability guide. Expire temporary authority. Some workflows need elevated access briefly. Time-limited credentials and one-task authorization reduce the blast radius of errors. Long-lived secrets should be avoided where possible.

Test denied actions.

Security testing should verify that the agent cannot access unrelated records, call unapproved tools, escalate its own privileges or bypass confirmation by changing phrasing. Permissions are product architecture. Least privilege can initially feel slower than giving an agent broad access, but it creates a safer path to expand automation. As agents gain capability, explicit authority boundaries become as important as model quality.

Apply least privilege at the action boundary

AI systems should receive only the authority required for the current task. Scope credentials by tool, resource, environment and time so stale workflow state or prompt injection cannot reuse broad standing access. The model may request an action, but deterministic policy should decide whether it is allowed. Bind credentials to lifecycle. Short-lived tokens are useful for agents because authority can expire with the session, workflow or approval. Refresh should require the same policy checks as the original grant.

Audit request, policy and effect.

Security logs should connect who initiated the request, what the model proposed, which policy allowed it and what external effect occurred. Denied and high-risk operations deserve stronger retention. Make capability boundaries machine-enforceable. Natural-language tool descriptions are not a security boundary. Define allowed operations, argument constraints, resource scope and approval requirements in deterministic policy that runs before execution.

Prefer short-lived access

Agents often need credentials for only a small part of a workflow. Ephemeral access reduces leak impact and simplifies cleanup after completion. Test revocation propagation. Disabling a user, tool or credential should also stop queued retries and delayed callbacks. Exercise expired tokens, replays and cross-resource identifiers so negative paths fail predictably.

Apply least privilege at the action boundary.

AI systems should receive only the authority required for the current task. Scope credentials by tool, resource, environment and time so stale workflow state or prompt injection cannot reuse broad standing access. The model may request an action, but deterministic policy should decide whether it is allowed. Bind credentials to lifecycle. Short-lived tokens are useful for agents because authority can expire with the session, workflow or approval. Refresh should require the same policy checks as the original grant.

Audit request, policy and effect

Security logs should connect who initiated the request, what the model proposed, which policy allowed it and what external effect occurred. Denied and high-risk operations deserve stronger retention.

Apply least privilege at the action boundary.

The model may request access, but deterministic policy should decide whether the current identity, resource and arguments are allowed. Scope credentials to the smallest useful resource set and workflow stage.

Short-lived authority limits damage from prompt injection, leaks and stale state because permissions expire when the task or approval window ends.

Exercise revocation and replay

Revoked users, expired tokens, delayed callbacks and replayed requests should fail consistently. Workers and caches must observe permission changes so old authority cannot survive in queued work.