AI agent governanceAI agent permissions

AI agent permissions: let agents act as the user, never as admin

AI agent permissions decide what an agent may read and change in each system it reaches. The safest default is simple: the agent acts with the permissions of the person who asked it, and nothing more.

Most problems with agents start with access that was granted for speed. A shared key or an admin account makes the first demo work, and then every user of the agent quietly gets the agent’s full access.

Three ways in

How agents usually get access, and what each means

A shared admin key

Fast to set up, the riskiest

One key with broad access, used for everyone. The agent can see and change everything the key allows, whoever is asking. The log shows the key, not the person.

Its own account

Better, but still one size for all

A service account just for the agent, with its own rights. It limits the damage, but everyone who uses the agent still gets the same access, and the account tends to collect more rights over time.

The user’s own login

The recommended default

Each person connects with their own login, and the agent acts with that person’s permissions in each system. It can never see or change more than the person could themselves.

Read, write, approve

Least privilege, in three steps

Start with read

Let agents read before they write. A wrong answer costs a minute; a wrong change to a customer record costs much more.

Grant write per group

Give write access only to the groups and systems where it clearly saves time, for example notes in the CRM for sales. Keep everything else read-only.

Keep a person in the loop

For anything that leaves the company or cannot be undone, let the agent draft and a person send. That rule keeps most of the speed and removes most of the risk.

With Deployed OS

How Deployed OS handles it

In Deployed OS each person connects with their own login, so an agent acting for them works within that person’s permissions in each system. Admins decide which groups may read or write in which system, and a group without access never sees the connection.

This is one of five controls every company needs for its agents. See all five in our guide to AI agent governance.

Questions about AI agent permissions

The rights that decide what an AI agent may read and change in each system it reaches: which records it can see, whether it can write, and on whose behalf it acts.

For work done on behalf of people, it is better that the agent acts with the permissions of the person who asked. Its own account gives every user the same access, often more than they have themselves.

Giving an agent only the access it needs for the task, and no more: read before write, write only where it clearly helps, and a person approving anything that cannot be undone.

Because everyone who uses the agent gets everything the key allows, and the log only shows the key. You cannot tell who asked for what, and one leaked key opens the whole system.