AI agents and permissions: what they can reach and why it matters

AI agent permissions decide what an AI agent can see and do: which mailboxes, files, systems and tools it can reach, and whether it can act on its own. This guide explains what AI agents are, how they connect to data and tools, and how the Australian Signals Directorate (ASD), OWASP and Microsoft describe limiting the risk, through least privilege, human approval and logging.

What an AI agent is

A chatbot answers questions. An AI agent goes further: it can plan steps and take actions, such as searching files, sending messages, updating records or calling other software, to reach a goal it has been given.

ASD’s joint guidance Careful adoption of agentic AI services describes agentic AI systems as “composed of one or more agents that fundamentally rely on an AI model”, such as a large language model (LLM). The guidance was co-authored by ASD’s ACSC with the cyber security agencies of the United States (CISA and NSA), Canada, New Zealand and the United Kingdom.

Agent features are increasingly appearing in workplace software. The convenience comes from access: an agent that can read the shared drive and send email can save a lot of time. The same access is what creates risk.

How agents connect to data and tools

An agent typically works through three kinds of access:

• Identity. The account the agent runs as. It might act as the person using it, or have its own service identity.
• Connected data. Mailboxes, calendars, document libraries, databases, customer records or websites it can read.
• Tools. Actions it can take: send email, create files, change settings, make purchases, run code or call other services.

The agent can usually do whatever its identity and tools allow. If it runs as an administrator, it may be able to do what an administrator can. If it can read everything a user can read, it may surface files that were overshared long ago; our guide to SharePoint oversharing and Copilot covers that problem in Microsoft 365.

Why permissions matter more for agents

OWASP describes a risk it calls excessive agency: “the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous” LLM outputs. It says the root cause is typically excessive functionality, excessive permissions or excessive autonomy.

ASD’s agentic AI guidance groups the risks into five types, including:

• Privilege risks, which it calls “a key concern for agentic AI”, such as an agent being compromised, its access growing over time (“scope creep”), or impersonation.
• Behaviour risks, where an agent acts in ways nobody intended.
• Structural risks, from the many connected agents, tools and third-party components.
• Accountability risks, where it’s hard to trace what an agent did and why.

OWASP’s Top 10 for Agentic Applications, released in December 2025, names ten risks for tool-using AI systems. They include “Agent Goal Hijack”, “Tool Misuse”, “Identity & Privilege Abuse” and “Human-Agent Trust Exploitation”.

Prompt injection: when content gives orders

Agents read content from emails, documents and web pages. That content can contain hidden instructions intended to redirect the agent, which is called prompt injection. ASD’s agentic AI guidance notes that attackers could “perform prompt injection attacks by including malicious prompts in phishing emails.”

Because the agent may treat those instructions as part of its task, the damage it can do depends largely on what it is permitted to do. Our explainer on what prompt injection is and how defenders limit it covers this in more depth.

A fictional example

Mia runs a small accounting practice. She sets up an agent to triage the shared inbox at accounts@practice.example: summarise new messages, file attachments, and draft replies.

To get it working quickly, the agent is given her full account access, including the ability to send email and change mailbox rules. A message arrives from billing@supplier-updates.example containing hidden text telling any AI assistant to forward recent invoices to an outside address.

What happens next depends on permissions. If the agent can only draft replies for Mia to review, she sees an odd draft and deletes it. If it can send email on its own, the invoices may leave the business without anyone noticing. The same message, very different outcomes. (Fictional; any resemblance is coincidental.)

How official guidance describes limiting the risk

Start small

ASD’s guidance recommends using agentic AI “only for low-risk and non-sensitive tasks” at first, and deploying it incrementally, “beginning with clearly defined low risk tasks.” The July news item describes “autonomy increasing only as confidence and assurance measures mature.”

Least privilege

ASD’s agentic AI guidance says to “Limit privileges of AI agents to the minimum required for its task.” ASD’s July 2026 news item puts it as “Limiting agent permissions to the minimum level required to perform approved tasks.”

Microsoft’s Security Blog describes the same idea in practical terms:

• Giving each agent “a dedicated agent identity (not a shared secret or reused service account)”, with a documented purpose and a named human owner.
• Using “least-privilege, task-based roles that are scoped to the specific resources and data the agent needs”, rather than broad owner or admin roles granted to get a pilot going.
• “Controlled tool access intended to limit the agent to approved actions”, with “explicit allowlists for high-impact operations.”
• Reviewing access regularly.

ASD’s guidance similarly describes building each agent as a distinct identity with its own keys or certificates, and warns against sharing secret keys or tokens across multiple agents. In Microsoft 365, admin roles and least privilege and app consent settings govern much of what agents and apps can reach.

Human approval for high-impact actions

ASD’s guidance describes preventing agents “from autonomously executing high impact actions or outputs without prior human approval.” Its July news item refers to “Maintaining human oversight and approval for high-impact or sensitive actions.”

Microsoft’s blog gives examples of high-impact actions, such as deletes, exports and privilege changes, and describes gating them behind step-up approvals, with “mandatory re-approval when workflows change materially.” OWASP also describes using human-in-the-loop control for high-impact actions.

Logging and monitoring

ASD’s guidance says to “Monitor all agent operations, including internal processes, not just the inputs and outputs.” The July news item refers to “comprehensive logging, auditing and accountability mechanisms.”

Microsoft’s blog describes the goal as “end-to-end auditability so you can answer ‘what happened, under what authority, and what changed?’” It lists details worth capturing, such as the agent’s identity, the role and scope it used, what it accessed, the action taken and the user it acted for. It warns that logging only the AI’s response produces an audit trail that is “useless for forensics.”

Questions to answer before switching an agent on

Based on the themes in ASD’s and Microsoft’s guidance, these are common questions to answer before an agent is switched on:

1. What exactly is this agent for, and who owns it?
2. Which identity does it run as, and is that identity shared with anything else?
3. Which data sources and tools can it reach, and are all of them needed?
4. Which actions can it take without a person approving them?
5. What is logged, where, and who reviews it?
6. How would it be switched off quickly if something went wrong?

Things to watch for

• Agents running as an administrator or as a person with broad access, “just for now”.
• Shared credentials or API keys reused across agents and other systems. See our guide to protecting secrets and API keys.
• Send, delete or pay actions that happen without anyone approving them.
• Agents reading untrusted content, such as inbound email or public web pages, while also holding powerful tools.
• Permission creep, where an agent gains more connectors over time and nobody reviews them.
• Logs that record only the chat, not the actions the agent took.
• No owner, so nobody notices when an agent’s behaviour changes.

Common questions

What permissions should an AI agent have?

ASD’s agentic AI guidance says to limit an agent’s privileges “to the minimum required for its task.” Microsoft’s Security Blog describes this in practice as a dedicated agent identity with a named human owner, task-based roles scoped to the specific data the agent needs, and allowlists for high-impact operations, rather than broad admin roles granted to get a pilot going. See least privilege for the full detail.

What is an AI agent and how is it different from a chatbot?

A chatbot answers questions, while an AI agent can plan steps and take actions toward a goal. Those actions can include searching files, sending messages, updating records or calling other software. ASD describes agentic AI systems as made up of one or more agents that rely on an AI model, such as a large language model. What an AI agent is explains how agents get their access.

Can prompt injection make an AI agent do things I didn’t ask for?

It can be used to try. ASD’s agentic AI guidance notes that attackers could include malicious prompts in phishing emails that an agent reads, and the agent may treat those hidden instructions as part of its task. How much damage follows depends largely on what the agent is permitted to do. Our prompt injection explainer covers how defenders limit it.

Should I let an AI agent act without a person approving it?

That is a decision for each organisation, but ASD’s guidance describes preventing agents from autonomously executing high-impact actions without prior human approval. Microsoft gives deletes, exports and privilege changes as examples of high-impact actions and describes gating them behind step-up approvals. ASD also describes starting with low-risk, non-sensitive tasks. See human approval for high-impact actions.

What do I do if I think an AI agent has been misused?

The ACSC takes reports through ReportCyber and runs a 24/7 hotline on 1300 CYBER1 (1300 292 371) for cyber security incidents, including a misused agent or connected account. ASD’s guidance describes logging all agent operations, not just the chat, and Microsoft lists the agent’s identity, scope, data accessed and action taken as details to capture, which helps answer what happened. See where to get official help.

What questions do I answer before switching on an AI agent?

Based on ASD’s and Microsoft’s guidance, common questions include what the agent is for and who owns it, which identity it runs as, which data and tools it can reach, and which actions it can take without approval. Others cover what is logged, who reviews it, and how to switch it off quickly. The full checklist lists all six.

Where to get official help

• ASD’s Careful adoption of agentic AI services and Engaging with artificial intelligence are the main Australian government references.
• If an AI agent or connected account may have been misused, the ACSC takes reports through ReportCyber and runs a 24/7 hotline on 1300 CYBER1 (1300 292 371).
• For the data side of AI tools, see our guide to AI assistants and confidential data.