What to check before granting an AI agent permissions

IC Guides · AI Agents · Governance and risk

By IC Lab Desk · Edited by Yajush Gupta · How we report

An agent is only as safe as what it is allowed to do. A common failure is an agent with too much access doing exactly what it was told, to the wrong thing. This guide covers the permission settings to check before launch.

The standard name for this risk

OWASP’s 2025 Top 10 for LLM applications calls it Excessive Agency (LLM06), which means damaging actions performed in response to unexpected, ambiguous or manipulated model output. It names three root causes, which map neatly onto what you configure.

Root cause (OWASP)	Example from OWASP	What to check
Excessive functionality	A mailbox summariser whose plugin can also send and delete messages	Which tools are switched on, and whether any are unused leftovers from testing
Excessive permissions	A read tool that connects with an identity holding update and delete rights	The scopes granted at connection, and whether it acts as the user or as a broad service account
Excessive autonomy	Deleting documents with no confirmation from the user	Which actions run without a human approving them

OWASP’s mitigation list is a useful audit script, minimise the tools offered, minimise what each tool can do, avoid open ended tools such as a raw shell command, minimise permissions, run tools in the user’s context, require user approval for high impact actions, and enforce authorisation in the downstream system rather than trusting the model to decide. It adds that logging and rate limiting will not prevent excessive agency but limit the damage. Its worked scenario is an email assistant hit by a prompt injection in an incoming message, and the fix is a mail reading extension with a read only OAuth scope and a manual send step.

Start with the least access

Give the agent the smallest set of permissions that lets it do one job. Read only first. Add write access for one system at a time, and only after you have watched it work. A service account with narrow scopes is safer than a shared login with everything.

Know the approval modes

There are three approval modes. In the first, a human approves every action, which is slow but the safest place to start. In the second, reads run freely while sends, edits and deletes need approval. In the third, the agent acts alone, which suits only low stakes work with a way to undo.

Check which mode is the default. A vendor default that favours convenience may not suit your risk.

Check how access is shared

Ask whether the agent uses each person’s login or one shared connection that others can borrow. Ask who can edit the agent and who can publish it, and whether others can see what it can do and what data it can reach.

Plan for the failure you cannot see

A cap on runs and spend stops a looping agent. For a wrong action, an undo path offers more protection than a warning. For false success, sample outputs by hand and not just the dashboard.

Questions to ask before launch

1. What is the worst thing this agent can do with its current access?
2. Can we undo it?
3. Who reviews a sample of its work each week?
4. Who can switch it off, and how fast?

Source

• OWASP GenAI Security Project, LLM06:2025 Excessive Agency, read 12 October 2026. Vendor specific controls are covered in Copilot Studio governance and ChatGPT workspace agents.

Pair this with the privacy and approval checklist and our AI governance guide. To see how vendors bill, use the AI Agent Pricing Tracker.

A simple pre-launch permission test

1. Read Confirm the agent can retrieve only the records its job requires.
2. Write Attempt a harmless test change outside its approved scope; the downstream application should reject it.
3. Approve Trigger a test action requiring human sign-off and verify nothing changes before approval.
4. Log Check that the record identifies the initiating user, tool action, approval and result.
5. Stop Disable the agent or revoke its credentials and confirm further actions fail.

Run these checks in a test environment with non-sensitive data. Keep the results alongside the deployment decision. A successful test demonstrates those specific controls under the tested conditions, not a blanket security certification.

Before procurement Use the privacy and approval checklist to request written vendor evidence, then review the build-or-buy decision with permission and oversight costs included.

Related guides Privacy and approval checklist · Copilot Studio governance · ChatGPT workspace agents · Build or buy · Which AI agent, and what it costs · AI Agent Pricing Tracker · All AI agent guides