What Permissions Should an AI Agent Have?

You connect an assistant to your email so it can sort the morning's messages. A screen asks what it may do: read, send, delete, manage your contacts. Most people tap Allow and move on. That screen is one of the most useful safety controls you have. When an artificial intelligence (AI) agent acts for you, the permissions you give it set the limit on what it can do, for better or worse.

The short answer: an agent should have the access its job needs, and nothing more. In security, that's called least privilege. It's an old idea. An agent that summarizes your email needs to read messages. It doesn't need to send or delete them. The Open Worldwide Application Security Project (OWASP), a nonprofit that tracks software risks, uses that exact example. A tool that can only read your email can't be talked into sending your files anywhere.¹

OWASP lists three ways an agent ends up with more power than it should have.

• Too many tools: it can reach features the job never uses, like a delete function on a tool meant only for reading.
• Too much access: it signs in with an account that can see far more than one person's files.
• Too much freedom: it takes big steps, like deleting or paying, with nobody confirming.

OWASP calls this excessive agency. In its 2026 list of top risks for apps built on large language models (LLMs), it ranks third.¹

An agent can go wrong without anyone meaning harm. It can misread what you asked. Or someone can hide instructions in a web page or email it reads, a trick called prompt injection. Nobody can promise to catch every planted instruction. What you can control is how much a fooled agent could do. Less access, less damage.²³

Some actions deserve a pause whatever the agent's access. Sending, paying, deleting, posting, and agreeing to terms are hard to undo. OWASP recommends that a person approve high-impact actions before they happen, and Anthropic's guidance for builders describes agents that stop at checkpoints for human feedback. If an agent you use offers a confirmation step, leave it switched on.¹⁴

Before you connect an agent to something, ask four questions.

• What does it need to read, and what does it need to change?
• Is there a read-only option?
• Which actions will it check with me about first?
• How do I switch its access off later?

Keep the answer to the last one handy. Connected apps are usually listed in an account's settings, where their access can be removed.

Access doesn't have to be all or nothing, or forever. Start small. Watch what the agent does over a few weeks, and widen its access only once it has done that particular job well, the same way you'd hand a new colleague more keys over time. Many tools also let you limit an agent to one folder or one account. Which of your connected apps can still do more than you need today?¹