AI Agent Least Privilege
A method for deriving the smallest workable capability set, and keeping it small.
Real rights,
real conditions.
Some work cannot be done from outside the boundary. A privileged agent holds rights over systems that matter, which raises the standard for everything around it.
READ THE DEFINITION ↓IDENTITY · CONDITIONS · RECORDS
01 / DEFINITION
The short answer first.What is a privileged AI agent?
A privileged AI agent is an autonomous system holding rights over sensitive resources — a system of record, a production environment, confidential documents, or actions with external effect. The privilege is what makes it useful and what makes every other control load-bearing.
The distinction is not technical but consequential. An agent summarising public documentation and an agent with write access to a matter management system run identical software. One has a worst case measured in wasted time; the other has a worst case measured in disclosure or an action that cannot be withdrawn.
Most published agent guidance assumes the first case. The operating conditions for the second are different, and they are worth stating explicitly rather than inferring from general advice.
02 / FIVE CONDITIONS
What has to be true before elevated rights are reasonable.Privilege AI's position, drawn from building systems where the underlying material is confidential by default, is that an agent with elevated rights is operable when five conditions hold together. Any one missing changes the risk materially.
- It acts as a person. The agent uses the requesting user's identity, so existing access controls apply and every action is attributable to a human who can be asked about it.
- It proposes before it acts. Actions with external effect start as drafts a person confirms, and move to autonomy only on a measured record.
- Its reach is bounded per run. Volume caps, step limits and short-lived credentials, so a single run cannot become a bulk operation.
- It has no free-form outbound path. Egress restricted to named destinations, which is what keeps read access from becoming disclosure.
- Everything is recorded and something reads the record. Complete trajectories, plus a sampled review that a person or a supervision model actually performs.
03 / WHERE PRIVILEGE IS UNAVOIDABLE
Cases that cannot be solved by narrowing.| Task | Why narrow access fails | Control that carries it |
|---|---|---|
| Cross-matter review | The question is about the whole corpus, not one file | Read-only, aggregate output, volume caps, full logging |
| Drafting from precedent | Requires access to prior work across clients | Identity-filtered retrieval; no cross-client leakage by construction |
| Reconciling systems of record | Needs write access to correct a mismatch | Proposal-only with human confirmation; reversible changes |
| Reviewing another agent's actions | Must see everything the first agent saw | Review-only authority; no ability to act on its own findings |
The last row is the case Privilege AI has built for directly. A supervision model that reviews AI-generated work and agent actions necessarily sees the same material as the systems it reviews, which is privilege by construction. MKC2 handles it with a hard ceiling rather than a narrower grant: it runs entirely offline, reports and flags, and does not act. Read access is broad; the authority attached to it is deliberately minimal. Details on the MKC2 page.
04 / THE FAILURE TO PLAN FOR
What a compromised privileged agent looks like.It will look
like normal use.
A compromised privileged agent does not trigger authentication failures. It uses legitimate credentials for legitimate operations in an illegitimate pattern.
This is the practical detection problem. Access logs show authorised reads by an authorised identity; the only anomaly is volume, sequence or timing. Detection therefore depends on the bounds and signals described in AI agent monitoring — records per run, scope-boundary events, egress attempts — rather than on authentication telemetry.
Containment depends on the same bounds. An agent whose credentials expire with the run, whose reach is capped, and whose outbound path is an allowlist has a bounded compromise. One with a standing service account and general network access does not, and the difference is set at design time rather than at incident time.
05 / QUESTIONS
Asked when an agent needs access to systems that matter.Should an AI agent ever hold administrative rights?
+
Rarely, and never standing. Where an administrative operation is genuinely needed, the pattern that holds is a proposal the agent prepares and a human executes, or a just-in-time elevation scoped to one operation and one run.
How is a privileged agent different from a privileged user?
+
A user's actions are deliberate and relatively few; an agent's are generated at machine speed from reasoning that untrusted content can influence. The same permission set is materially riskier in an agent's hands, which is why volume bounds and review-only defaults matter more.
Can a privileged agent run on a hosted model?
+
It can, and it means every piece of context the agent reads reaches a third party. Where the material is confidential by default — privileged legal documents being the clearest case — that is usually the decisive argument for local inference. See private AI inference.
What is the minimum logging for a privileged agent?
+
Every tool call with arguments, the identity used, a reference to the content that prompted it, the response, and the resulting action — enough to replay the run. Logging only the final output makes any later investigation impossible.
How do you justify a privileged agent to a risk committee?
+
With the five conditions above, evidence for each, and a statement of the worst case and its reversibility. An argument based on model quality alone tends not to survive the question of what happens when the model is wrong.
Elevated rights,
explicit limits.
Privilege AI builds systems where permissions, retrieval boundaries and private deployment are decided together.