Which permissions should you give an AI agent?
Start by listing the actions the job requires. “Access to our CRM” is too broad to review. A sales preparation assistant might need to read assigned account notes and create a private draft. Sending offers, exporting the full database and changing account owners are different actions with different consequences.
Build a small access matrix
For each action record the system, the records in scope, the permitted operation and the approver. A sample row could say, “Support system, tickets in our returns queue, read ticket text and create an internal draft, approved by the support manager.” Give separate rows to attachments, customer details and public replies. A connector may bundle several capabilities in one permission even when the task needs only one.
Ask the builder to explain which restrictions the receiving system enforces. A written instruction telling an agent to avoid changing an order is weaker than credentials that cannot change it. Excessive tool access and permissions are recognized sources of agent risk.
OWASP’s guidance on excessive agency
Test a legitimate request outside the boundary
Use a test identity with the same restrictions intended for production. Give it an in-scope ticket, then one owned by a different customer team. Confirm it can prepare the first draft and cannot read the second. Test a prohibited write as well. Retain the result from the receiving system so a reviewer knows where the denial occurred.
Name an owner for the account and choose when access expires or gets reviewed. Record who can disable it without waiting for the original builder. If the job expands later, review the new action separately. A request to summarize renewal terms does not automatically justify permission to modify contracts or contact a customer.
Put this into practice
Bring a sample of the work and the tools your team uses. We can help define a first project, who reviews it, and how to tell if it works.
Explore AI implementation · Discuss your project with Escencion
