For decades, cybersecurity professionals have relied on the principle of least privilege: Only give identities the access needed to perform their jobs. That principle remains essential. But AI agents have exposed its limits.

An AI agent can have exactly the right permissions and still do the wrong thing

Consider an agent authorized to issue customer refunds. Least privilege can constrain which customer records and payment systems the agent can access. But those permissions alone don’t determine how large a refund it can approve, under what circumstances it should act, or whether it can execute thousands of refunds without human review. The problem isn’t necessarily excessive access — it’s excessive agency.

Least privilege primarily constrains access: What resources can this identity reach? AI agents introduce additional dimensions because they can make decisions, invoke tools, pursue objectives, and act with varying degrees of independence.…