Your AI Agents Have Keys to Everything. Nobody's Watching the Doors.

Find the access behind the interface

The headline describes a risk to investigate, not a finding about every organization. An agent may look like a chat window while its tools can read documents, update records, send messages, or initiate a workflow. The security boundary is the connected capability, not the appearance of the interface.

Ask a simple question: if the agent followed a bad instruction, what could actually happen? Answer it with the permissions and workflows in the deployed system, not the intended behavior shown in a demo.

Give each agent an accountable owner

Record the business purpose, technical owner, approving authority, connected systems, and the identity used for each connection. Include how access expires or is reviewed. Shared credentials and inherited broad permissions make accountability harder, even when the original use case is benign.

Distinguish the person who requested a task from the identity that executes it. If the downstream system only sees a powerful service account, it may be unable to enforce the requesting person's narrower authority. That gap needs an explicit design decision.

Check access against the actual job

OWASP's excessive-agency guidance warns about overly broad functionality, permissions, and autonomy. A practical review starts with what the job needs today rather than what might be convenient later.

Source: OWASP: LLM06:2025 Excessive Agency →

• Purpose: what outcome is this connection for?
• Scope: which records, environments, and actions are necessary?
• Approval: which actions require a person's decision?
• Evidence: can reviewers reconstruct what was requested and performed?
• Revocation: can the organization disable the identity without breaking unrelated work?

Inspect a complete journey

Take one representative task from request to outcome. A document-summary agent may begin with read access and end with a proposed email. Check whether the system can send it, to whom, using which identity, and with whose approval. Do not assume that access to a source authorizes disclosure to a new recipient.

Test the boundary with a harmless synthetic instruction in an external document. The goal is to see whether source content can change the destination, expand the task, or activate a tool. Run this only in an authorized, isolated test with non-sensitive data.

Make the emergency stop real

A stop button is useful only if the team knows what it stops. Test whether stopping the agent also prevents queued actions and whether existing sessions or credentials remain usable. Define who can revoke access and who assesses work already completed.

Keep logs that support investigation without turning them into a store of passwords, tokens, or unnecessary personal information. Review the agent after changes to tools, models, permissions, and business purpose. An unchanged name does not mean an unchanged risk.

The useful outcome is not a bigger inventory spreadsheet. It is a smaller set of understandable permissions, clear owners, and evidence that the limits work.