Least Privilege for AI Agents: 4 Controls Before They Touch Production

By Delos Intelligence — 2026-10-23

AI agents hold broad access and act at machine speed. Apply least privilege with four concrete controls: scoped identities, short-lived tokens, approvals, audit.

An AI agent that can read your CRM, write to your ERP and send emails is not a chatbot: it is an employee with no HR file. SailPoint's 2025 research found that 82% of organizations already use AI agents, but only 44% have policies to secure them. More than 80% of organizations using agents reported unintended behavior, including unauthorized access and accidental data disclosure.

That is the gap: agents have access to act, but their permissions often have not caught up with their autonomy.

Why least privilege matters more for agents than for people

Agents act at machine speed, chain tools together, and are often given a shared service account “to make it work.” A human who over-reaches is slowed by friction; an agent is not. The NIST definition of least privilege is to give an entity only the access needed for its task. For an agent, that limits the blast radius of a prompt injection, a bad tool call or a hallucinated action.

The four controls

The goal is not to ban agents. It is to make each permission specific, temporary and accountable. SailPoint's guide to securing AI agents also frames agent identities as an enterprise access-control challenge.

1. One identity per agent

Do not use shared accounts. Give each agent its own identity and a named human owner. Maintain a registry of every agent, the tools it can call and the systems it can reach. When access changes, you should know exactly which agent is affected. The ownership model is explored further in our AI agent accountability guide.

2. Scope by task, not by team

Start with read-only access. Separate read and write tools, and deny access to data domains such as finance, HR and legal by default. Grant only the fields and actions needed for the current task, not every permission available to the department.

3. Short-lived, just-in-time credentials

Issue a token per task that expires in minutes and rotates automatically. Do not put static API keys in prompts or configuration files. A credential that disappears when the job is done cannot be reused indefinitely after a leak.

4. Human approval and audit on irreversible actions

Payments, deletions, external emails and contract changes require a human click before execution. Log every call with the agent identity, tool, data touched and outcome. An approval without a trace is not enough; a log without a gate cannot undo a payment.

For the wider discovery and monitoring problem, read our shadow AI governance playbook.

A concrete example: an accounts-payable agent

It should read invoices and the vendor master, propose a match and draft a payment batch, but never release a payment or edit bank details. Release requires human approval; bank detail changes go through a separate workflow. If the agent is compromised, the worst case is a wrong draft, not a wire transfer.

A 30-day rollout

Week 1: Inventory every agent and the permissions it actually has. Week 2: Remove standing write access and shared keys. Week 3: Introduce short-lived credentials and approval gates for irreversible actions. Week 4: Review logs, alert on unusual access and schedule quarterly recertification of agent permissions, just as you would for employee access.

Common mistakes

Granting admin access “to get the pilot working”; reusing a developer's personal token; trusting a prompt that says “never delete anything” instead of enforcing that rule in permissions; and leaving no owner when the project team moves on. None of these is a technical shortcut once an agent reaches production.

Conclusion

Governance that exists only in a policy document does not stop an agent. Enforce least privilege in the identity layer, and scale agents only as fast as you can audit them. Delos Workers are designed with scoped access and auditability in mind.