AI agent permissions: controls buyers must require

AI agent permissions have become the weak point in enterprise deployments. Endpoint agents execute code, call tools, move data and make decisions. Many run with full user-level rights and were never reviewed by IT, security or legal. They were installed by an employee and inherited that person's access (CIO). For procurement and IT leaders, that turns a tool purchase into an access-control decision. Settle it before signature, not after go-live.

The scale of the gap is visible in the data. Nearly half of 300 US CISOs and CSOs surveyed found an agent running in production this year with access it should never have had (Agen). Half had an agent security incident in the past year. Of those, 61% learned about it after the fact. Contracts are the only lever most buyers have to close this gap before deployment.

Why AI agent permissions belong in the contract

An agent with delegated access is not a dashboard. It acts on connected systems: it writes records, sends messages and triggers downstream workflows. Current authorization frameworks often grant broader access than a task needs. Agents chain actions in ways developers cannot fully predict (ACM CHI 2026). Product-level policies alone will not fit every user's context, so user-level policies matter too (arXiv).

Buyers feel this. In a January 2026 survey of 150 IT and security decision-makers, 69% said security concerns were slowing AI agent adoption. 80% cited over-privileged access as a barrier (Okta). Those numbers tell you where negotiation should focus.

A contract that names the permission model, the evidence and the exit route gives your security team something to enforce. Without it, you rely on a vendor's assurance and an employee's judgement.

Start with discovery: you cannot govern what you cannot list

Before writing clauses, get an inventory commitment. Ask the vendor how an agent is registered and whether each agent has a unique identity. Ask how you can see every agent connected to your environment.

Only 34% of surveyed security leaders got their agent count from a tool that discovers agents automatically (Agen). If the vendor's answer is a spreadsheet, treat the deployment as unmanaged.

Make discovery a contractual deliverable:

• A written list of every agent identity created, its owner and its business purpose.
• A documented method for you to enumerate agents at any time without vendor assistance.
• Notice to your security team within an agreed window whenever a new agent or tool connection is enabled.
• A commitment that employee-installed agents cannot bypass the registry.

Then check how the agent authenticates. Most organisations check identity once, at registration or session start. Only 18% check before each action (Agen). Per-action checks are the standard to ask for. The Scopelyst guide to AI agents sets out the deployment models to weigh before you commit.

Write least privilege into the scope

Broad, persistent API scopes are the default in many integrations. They are the reason a finance agent can sometimes read HR files. Require task-scoped, time-bound AI agent permissions instead.

Make vendor selection a comparison of real control evidence, not a scored demo. The Scopelyst directory of cybersecurity services lists providers who can test the controls independently.

Your clauses should require:

1. 1Permissions granted per task, not per user session, with a stated expiry.
2. 2A named enforcement point that checks permission at execution, not only at login.
3. 3Deny-by-default behaviour for tools and data stores outside the approved workflow.
4. 4No agent-to-agent credential passing without written approval from your security owner.
5. 5Evidence for each proposed action: who or what initiates it, what it can change, and who approves it.

Where the workflow requires a human decision, specify the approval model. Approval-gated execution should bind the approval to the exact proposed action. Attempted replay must fail (Percepture).

Demand audit trails that survive a review

Logs are where accountability lives, and agent activity is easy to blur. Suppose an agent runs on an employee's credentials. The audit trail then shows a person doing whatever the agent did. 40% of surveyed companies run agents that way (Agen). Insist on attributable agent identities.

Specify what a record must contain: timestamp, agent identity, input received, tools called, data read or written, approval reference and outcome. Ask for a live demonstration of the trail for the exact product version you are buying. Do not accept a description of it.

Set retention terms that match your regulatory obligations. Clarify where logs are stored and who can query them. Confirm you can export them in a usable format if you leave the vendor.

The privilege boundary is the contract

Agents optimise for the task they are given. A file-sharing agent once chose a public service as the most efficient route and made internal data public. The agent was not compromised; it applied no contextual judgement (CIO). Your permission boundary has to hold when the agent is working exactly as designed.

Test the stop switch before you sign

A convincing demo is not an acceptance test. Ask for a bounded workflow, evidence of denied actions and a recovery exercise before expanding access (Percepture).

Run these checks during evaluation:

• Ask the agent to do something outside its scope. Confirm the action is blocked and logged.
• Revoke permissions from a live agent and verify the effect is immediate. Only 18% of surveyed companies check identity before each action, so revocation often lags (Agen).
• Simulate an approval that expires or a reviewer who is unavailable. See how the agent behaves.
• Confirm the stop condition and who can trigger it without vendor help.

Where a vendor offers a corporate AI agent platform, publishing data residency and training opt-out terms is now table stakes. A small vendor that cannot match that standard should be treated as a red flag (Act Five).

Make the requirements answerable in your RFP

Vague security questions produce vague answers. Ask for evidence against each action in your workflow. Include a row for what the agent must never do as well as what it may do. The Scopelyst guide on how to write an RFP for IT services shows how to structure questions so vendors respond with specifics rather than brochures.

When you are ready to compare suppliers, post your project with the permission requirements attached. Vendors who cannot answer them will self-select out, which saves review time.

Include these clauses in the draft agreement:

• A definition of permitted actions, data and destinations, tied to a named workflow.
• A verification right: you may test denial, revocation and recovery before acceptance and at renewal.
• An incident notification window for unauthorised agent actions, with the evidence you expect.
• A change-control term: scope expansion requires written approval from your security owner.
• Exit terms covering log export, credential revocation and agent decommissioning.

Vendors preparing a response should say plainly what the product enforces and what relies on configuration. They should show the enforcement point rather than describing it.

Frequently asked questions

What are AI agent permissions?

They are the access rights an agent uses when it reads data, calls tools or changes records in connected systems. Unlike a user login, AI agent permissions should be scoped to a task and checked at each action rather than granted once for a whole session.

Should AI agents run with full user-level permissions?

No. Running an agent with a person's full rights lets it inherit credentials it does not need, including admin access. Ask for task-scoped, time-bound AI agent permissions with deny-by-default behaviour for anything outside the approved workflow.

How do I audit what an AI agent did?

Require a record for every action with timestamp, agent identity, input, tools called, data touched, approval reference and outcome. Ask for a live demonstration on your own workflow. Confirm you can export the logs if you leave the vendor.

Who is accountable when an agent acts outside its scope?

That question is still unresolved in practice, which is why the contract has to answer it. Name the business owner, the approval authority and the notification duty before deployment. Responsibility should not depend on after-the-fact interpretation.

What this means for buyers

Treat AI agent permissions as a gate, not a feature comparison. Before signing, confirm three things. You can enumerate every agent identity. Permissions are task-scoped and checked per action. Denied actions are demonstrated on your workflow. Put the verification right in the contract, with a renewal check.

Bring your CISO into the purchase conversation early. Security concerns are already slowing adoption for 69% of surveyed leaders (Okta). A contract that settles the controls removes that blocker instead of deferring it.

What this means for vendors

Buyers will increasingly score your proposal on evidence, not claims. Prepare a dated record for the exact version you are selling. Cover the enforcement point, permission scopes, denial tests, audit format and exit process. Vendors who can show a blocked action and a clean revocation win trust faster than those who promise them.

Agents are already producing detection leads at 2.5 times the rate of human-triggered activity on monitored endpoints (CIO). Expect security reviewers to ask harder questions each round. Answering them in writing, before the RFP, is now part of selling.