Agentic AI Security: Why Agents Need Least Privilege More Than Humans Ever Did
Agents get the same broad permissions humans built up over years — without the judgment or self-control that made those permissions safe enough for people. RBAC was built for humans. It breaks for agents.
Agentic AI security is the biggest challenge facing companies putting AI agents into production. The core problem is simple: agents get the same broad permissions humans built up over years, but agents don’t have the judgment or self-control that made those permissions safe enough for people. Role-based access control was built for humans, and it breaks down for agents in ways that demand a different approach to least privilege.
On episode 89, Graham Neray, co-founder and CEO of Oso, walked through why.
Why over-permissioning worked for humans but fails for agents
Most permission systems come down to roles: an engineer gets “admin,” a support rep gets “viewer plus escalation.” These work because humans hold back — they have context, they use judgment, they don’t want to get fired. “We tolerate a lot of over-permissioning in all the apps that we use because there’s a finite limit on the amount of time that you or I have to do bad or stupid things,” Neray said.
Agents break all of those assumptions. They don’t follow fixed rules — even with a clear instruction, an agent might read the goal wrong, find an unexpected shortcut, or get manipulated through prompt injection. It has no loyalty and no instinct to pause before running a dangerous command. And speed alone changes everything. As our co-founder Sasha Sinkevich said on the show: “If a human takes a day, an agent probably takes milliseconds to execute the same vulnerability.” A misconfigured agent can blow through multiple services before any alert fires.
When an agent has too much access
These risks aren’t theory. In July 2025, SaaStr founder Jason Lemkin ran a vibe-coding experiment on Replit. On day nine, the agent deleted his production database — records on over 1,200 executives and nearly 1,200 companies — then tried to cover it up, claiming a rollback wouldn’t work. “Day nine, Replit agent goes rogue, deletes the production database, and lies about it,” Neray recounted. Gravitee’s 2026 State of AI Agent Security report found 88% of organizations had confirmed or suspected security incidents tied to AI agents, while only 14.4% had full security approval for their deployments.
Three reasons RBAC breaks for agents
Agents don’t hold back. A human with admin access might use 10% of their permissions in a month; an agent uses whatever helps it finish its goal, without understanding the risk. Roles are fixed, but agent tasks keep changing. A task that starts read-only can grow into code generation needing write access — fixed roles either block the workflow or open too much. Agents move at machine speed. A human mistake causes limited damage before someone notices; an agent triggers harmful actions across services before any alert fires.
What least privilege looks like for agents
For humans, least privilege means watching used permissions over a rolling window and trimming the rest. That doesn’t carry over — an agent’s task changes every run, so a 30-day usage pattern tells you nothing. The new model scopes permissions to each task:
- Delegated access — the agent inherits the permissions of the user who called it, and never exceeds them.
- Just-in-time provisioning — permissions granted when a task starts, revoked when it ends. No leftover access accumulates.
- Real-time checks — each action checked against the minimum needed for that specific task, not a stored role.
- Human approval for sensitive actions — deletion, transfers, infrastructure changes need a person to sign off.
Neray frames the target: “The world that we’re headed towards is one in which you can dynamically scope down the privileges of an agent for any given task based on the fewest privileges required to achieve that task. That’s the holy grail.” This is the runtime floor that pairs with governance at onboarding deciding the ceiling.
Why most companies aren’t ready
From six months of meetings with over 100 CTOs and CISOs, Neray found AI-native companies pushing agents hard, growth-stage companies shipping “toys” (purely generative, no customer data, not customer-facing) because the board asked, and enterprises mostly wrapping up proofs of concept. Gartner forecasts 40% of enterprise applications will have task-specific AI agents by the end of 2026, but the gap between building agents and securing them stays wide. The bottleneck isn’t the AI — it’s authorization. “If you want to add agents to your product, you basically have to figure this out.” That’s the layer we help teams get right in product security before agents reach production.