Least Privilege & Least Agency

Least privilege for agents bounds what they can touch; least agency — Forrester's extension — bounds what they can decide. Both are needed, because an over-permissioned agent operates at machine speed with no implicit human brake.

What it is

Least privilege grants an agent only the narrowest capability its task requires: specific resources, specific operations, nothing standing by "just in case." Forrester's AEGIS framework adds least agency as a foundational principle — limiting not just access but the degree of autonomous decision-making an agent is allowed before a human or policy check intervenes.

Fine-grained authorization (FGA) is the enforcement vocabulary: Permit.io's AI Access Control assigns machine identities to agents and specifies exactly "which API calls, transactions, and operations are AI-authorized," rather than granting tool access wholesale.

Why it matters

• The blast radius is no longer human-bounded. A person with excess permissions misuses them slowly; an agent exercises the full grant at machine speed, unattended. Oso cites the Replit incident, where an AI coding agent deleted a production database — the canonical example of an over-permissioned agent without guardrails.
• Over-provisioning is the default failure mode. Agents "inherit permissions through APIs and dynamic workflows" (BigID), and broad grants accumulate silently unless scoping is deliberate.
• Coarse grants can't be audited meaningfully. If everything was allowed, the audit trail explains nothing. Narrow grants make Auditability informative.

Best practices

• Scope by compartment and start from the least-privileged member. Claude's agent-identity model configures each channel's access profile to match the lowest-privileged member of that channel — the compartment's floor, not its ceiling.
• Then audit and adjust. Anthropic's operational advice is to grant a workable baseline, watch actual usage, and pare back where access goes unused — least privilege as a continuous process, not a one-time setup.
• Express permissions as fine-grained policy (which operation, on which resource, under which conditions) using ABAC/ReBAC-style models rather than binary tool on/off switches (Permit.io). Enforce them at runtime — see Runtime Authorization.
• Cap agency, not just access. Define which decisions the agent may take alone, which require policy checks, and which require a human — AEGIS's least agency, operationalized in Human-in-the-Loop Oversight.
• Make elevation temporary. When a task genuinely needs more, grant it just-in-time and let it expire — see Just-in-Time Access.

Examples

• A support agent may read any ticket but write only to tickets assigned to its invoking user, and may never touch billing APIs — three separate fine-grained rules where a coarse integration would have granted one big "helpdesk access" (Permit.io's FGA model).
• A legal-channel agent structurally cannot reach code repositories: the capability isn't denied at request time, it was never in the compartment's identity at all (Claude/Anthropic).
• An agent scheduled to run quarterly reporting gets predictive, time-limited elevation for the reporting window instead of standing warehouse-admin rights (Oso).