Agent Security
AI Agent Permissions: What Your Agent Should and Shouldn't Access
Most AI agent security problems aren't exotic attacks — they're agents with more access than they need. Here's how to think about permissions for a small business AI setup in 2026.
The principle of least privilege — applied to AI agents
Give each agent exactly the access it needs for its specific job and nothing more. A booking agent needs calendar access. It does not need your CRM, your Stripe keys, or your email. Separate permissions by workflow, not by convenience.
What agents commonly over-request
- Full email read/write when they only need to send confirmations
- Database write access when they only need to query
- Admin-level API keys when a scoped read-only key works
- Access to production systems when a staging environment would do
- Cross-workflow data access that creates leakage paths between unrelated systems
What permissions to audit right now
- List every tool your agent can call. Remove anything it hasn't used in 30 days.
- Check if any agent has API keys that can delete or modify data it shouldn't touch.
- Ensure no agent has access to customer PII beyond what its specific task requires.
- Verify that agent credentials are rotated and not shared across workflows.
When to escalate to a human before acting
Any action that is irreversible, touches money, modifies infrastructure, or sends customer-facing communications should require explicit human approval before execution. Speed is not worth the cost of an irreversible mistake.
Need a human to review your agent setup?
Real operator. No ticket queue. San Diego-based. Most AI workflow security questions close in one thread.
Text PJ → 858-461-8054
More in the Agent Security cluster:
