How Should AI Agent Permissions Be Set, and Which Actions Must a Person Approve?
Use least privilege. Each AI Agent gets only the tools, data, and accounts its job needs, and read-only wherever possible. Any action that sends externally, spends money, deletes, or changes production data runs only after a designated person approves. Permissions must be enforced by the systems themselves, not by writing "don't do this" in a prompt.
1. What goes wrong with too much permission
OWASP calls this Excessive Agency (LLM06:2025): when an AI's output is wrong, ambiguous, or manipulated, the system lets it take a damaging action. There are three root causes, alone or together:
- Excessive functionality: tools the job does not need, such as an email-sending tool connected to an agent that only reads documents.
- Excessive permissions: tools with too much access, such as an account that can modify a database when the job only needs to query it.
- Excessive autonomy: high-impact actions executed without a person confirming.
AI Agents make mistakes and can be misled by instructions hidden in documents (see "What is prompt injection?"). With the right permissions, the damage from a mistake stays small.
2. Six steps to set permissions
Based on OWASP LLM06 mitigations and the security best practices for MCP (the open protocol AI Agents use to connect tools):
- Connect only the tools needed. Write down the agent's job and connect only the tools it requires. Prefer purpose-built tools over open-ended ones such as running arbitrary commands or opening arbitrary URLs.
- Enable only needed functions in each tool. A document-reading tool should not include deletion.
- Minimize account permissions. Read-only wherever possible. MCP recommends starting with the smallest scope and raising it step by step when needed, logging each elevation.
- Act as the user. An AI Agent working for someone uses that person's permissions, not a shared account that can see everything.
- Let downstream systems decide authorization. Whether an action is allowed is set by the permissions in the database, file system, or mail system, not by the model's judgment.
- Require human approval for high-impact actions. External sending, spending, deletion, production changes, personal data, and commitments to outsiders pause until a designated person confirms.
Also, locally installed MCP tools run with the same system privileges as the AI client. MCP recommends showing the full command and getting the user's consent before connecting a new tool, and running it in a sandbox with restricted access.
3. Sample permission table
During deployment, write each AI Agent's permissions into a table signed off by the company's owner. This is an illustration, not any real company's setup:
| AI Agent | Can read | Can write | Always needs human approval |
|---|---|---|---|
| Customer service agent | Approved FAQs, product descriptions | Reply drafts | Refunds, compensation, any commitment to customers |
| Sales assistant | Product catalog, pricing rules | Quote drafts | Sending to customers, discounts outside the rules |
| Admin assistant | Company policies, form templates | Internal summaries | Sending official letters, changing HR records |
| Accounting assistant | Invoices and ledger details (read-only) | Reconciliation discrepancy list | Any payment or transfer (no payment function connected) |
Once the table is written, verify it with tests that check forbidden actions really fail, for example asking the customer service agent to send a refund confirmation directly and confirming it stops for approval.
How Think BIG sets AI Agent permissions
Think BIG (Think BIG Make it Real Co., Ltd.) is an enterprise AI Agent deployment provider headquartered in Taiwan. Starting from protecting company data, we build AI Agents inside the client's own environment (company hardware, or a cloud server under the company's account). There are two deployment options: with the on-premises version, models and documents are processed on company hardware; with the cloud-assisted version, employees' questions and the document passages the system retrieves are sent to the model provider for processing.
- Least privilege: for each AI Agent we confirm data sources, processing location, read/write scope, and access roles according to the work required.
- Human approval kept: external sending, spending, and production system changes require approval from a designated person. AI Agents provide work output and evidence; people keep the key decisions.
- Permission changes recorded: adding or adjusting permissions leaves a change record, and the data and permission list covers sources, storage locations, read/write scope, external services, and approvers.
See Trust and On-premises AI and data sovereignty.
The actual scope of Think BIG's services follows what both parties confirm.
FAQ
- Q1: What is "excessive agency" in AI Agents?
- OWASP LLM06:2025 describes it as a system letting an AI take damaging actions when its output is wrong, ambiguous, or manipulated. The causes are excessive functionality, excessive permissions, and excessive autonomy.
- Q2: Which AI Agent actions must a person approve?
- Sending externally, spending money, deleting, changing production systems, and anything involving personal data or commitments to outsiders should pause until a designated person confirms.
- Q3: Is writing "don't do X" in the prompt enough as access control?
- No. OWASP recommends enforcing authorization in downstream systems rather than relying on the model's judgment. Set permissions in the database, file, and mail systems.
- Q4: Can an AI Agent use a shared admin account?
- Not recommended. OWASP recommends acting in the user's own context with minimally scoped credentials, so the agent cannot see or do more than the user is allowed to.
- OWASP GenAI Security Project, LLM06:2025 Excessive Agency (three root causes, eight mitigations): genai.owasp.org
- Model Context Protocol, Security Best Practices (scope minimization, consent and sandboxing for local servers): modelcontextprotocol.io
- OWASP GenAI Security Project, LLM01:2025 Prompt Injection (least privilege, human approval): genai.owasp.org
This article summarizes public official documents, laws, and security standards to help companies evaluate AI adoption. It is not legal advice. For Taiwan law, the latest text on the Laws & Regulations Database prevails; external documents, prices, and specifications follow their original sources. The actual scope of Think BIG’s services depends on what both parties confirm.