Resource hub · Security
Least privilege and AI agent security for security leaders
Broken access control is still the top application risk, and AI agents make it worse. An agent that simply inherits a user's permissions can do anything that user can do, at machine speed, with no record of intent. That is an anti-pattern, and it is how many agents ship today.
This page gathers our best thinking on keeping privileges small and provable for humans and agents alike, plus the controls Permit MCP Gateway puts in front of agent tool calls.
Problems this page helps with
- Agents holding broad, long-lived access they do not need
- No runtime check between an agent's plan and the action it takes
- Proving to the board and auditors that least privilege actually holds
The short version
Least privilege has to hold for agents as well as people. Give every agent its own scoped identity, check each tool call at runtime outside the model, and keep a log that proves it.
Key concepts
Least privilege
Each identity gets only the access its current task needs, and nothing it might need later.
Zero standing privilege
Access is granted for a task and expires with it, so no identity keeps broad rights between jobs.
Inherited permissions
An agent that simply inherits its user's permissions is an anti-pattern. It can do anything the user can, at machine speed.
Runtime gate
A policy check outside the model, so injected text cannot turn into an action the policy does not allow.
Where the check sits for an agent
- 1
Human
delegates a scoped task
- 2
Agent
has its own identity, not the user's
- 3
Policy gate
checks every tool call, asks a human when needed
- 4
Tool or data
acts only if allowed, and it is logged
Two ways to ship an agent
Agent inherits the user
- Holds every permission the user has
- No check between the plan and the action
- Logs show the user, not the agent
Agent with its own scoped identity
- Scoped to the task and the delegating human
- Every tool call checked by policy at runtime
- Attributable record of who delegated what
How Permit handles it
- 01
Separate agent identities
Permit MCP Gateway represents each agent with its own identity, bound to the human who delegated the task, so access is scoped and attributable.
- 02
Check every tool call
The gateway sits in front of your MCP servers and runs a policy check on each call, without rewriting the servers.
- 03
Human approval where it matters
Sensitive actions can require consent or approval before they run.
- 04
Proof for the board
Decision logs turn "we have least privilege" into evidence you can show an auditor.
“When we build applications, secure access is at the forefront of our minds. Application authorization is a huge pain point for companies, as one of the largest and most rapidly expanding attack surfaces. I was excited to discover Permit.io, which, to date, provides the most advanced authorization solution , based on open-source standards and supporting multiple policy models.”
Go deeper
Agent permissions
- BlogDo AI agents inherit user permissions?Why inheriting the user's access fails, and why each tool call needs its own check.
- BlogTreat AI agents as privileged identitiesDistinct identity, least privilege, attributable delegation and forensic logs, mapped to NIST NCCoE.
- BlogLeast privilege for AI agentsDefines agentic identity as the delegating human plus workflow context plus declared intent.
- BlogZero standing privilege for AI agentsHow zero standing privilege differs from least privilege and how to enforce it so no identity keeps access between tasks.
Threats to plan for
- BlogPrompt injection is an authority promotion failureShows where to put a runtime authorization gate outside the model so injected text cannot turn into an action.
- BlogA poisoned Linear ticket told our agent to leak the teamA real test of an agent being steered by injected content, and what stopped it.
- BlogSecuring coding agentsThe real risks of agents that run commands and call APIs, and why checks belong at the tool call.
Permit MCP Gateway
- ProductPermit MCP GatewayIdentity, consent, policy and audit for every agent tool call, without rewriting your MCP servers.
- BlogThe six layers every MCP gateway must enforceA blueprint for securing MCP agents across identity, consent, policy and audit.
- DocsMCP Gateway documentationHow the gateway authorizes, records and gates agent tool calls.
Make the case
Permit MCP Gateway has a free tier with 1,000 MAU, 10 tenants, 1 environment and 7 days of audit logs.