Skip to content
Founderz: Responsible Use of AI home

in collaboration with Microsoft

The ten principles

Principle 04 · Before you start · Agents and security

Limited permissions for AI agents

AI agents get only the access their task requires, and anything irreversible needs a person’s confirmation.

Key question

What’s the worst this agent could do with the access it has?

Benefit

Agents can take on real work, because a mistake or a manipulation stays contained.

Context

An agent works with your access. Anything it can read can try to give it instructions, and anything it can do, it can do by mistake. The more an agent can reach, the more it can help, and the more one error or one malicious email can cost.

Security teams call the safe default least privilege: give each system only the access its task needs. It’s the rule you’d apply to a new colleague on their first day.

Permissions and prompts

Telling an agent “don’t send anything” is a request. Setting its access to draft-only is a lock. Use both, and rely on the lock. Singapore’s framework for agentic AI agrees: where possible, the system itself should enforce approvals.

OWASP’s list of the main security risks for AI applications calls the failure excessive agency: an AI system with more functions, permissions or autonomy than its task needs. Its 2026 edition recommends that a person confirm privileged, irreversible or externally visible actions.

Prompt injection

Emails, web pages and shared documents can contain text written to steer an AI that reads them. This is prompt injection. The UK’s National Cyber Security Centre warns that it may never be fully fixed, so the defense is to limit what a tricked system can do.

Security researcher Simon Willison describes a “lethal trifecta”: an agent that can read your private data, is exposed to content from strangers and can send information out can be tricked into leaking that data. In practice, avoid giving one agent all three at once, unless your IT team has designed that setup on purpose.

You don’t need to spot every attack. Notice when an agent suddenly wants to do something you didn’t ask for, stop it and report it.

Practices

  1. 01Start with read-only or draft-only access, and add permissions one at a time.
  2. 02Confirm anything irreversible: sending, paying, deleting, sharing outside your organization.
  3. 03Avoid giving one agent your private data, content from strangers and a way to send things out, all at once.
  4. 04Stop an agent that wants to do something you didn’t ask for, and report it.
  5. 05Set limits on money, recipients and time, and know how to switch the agent off.

Prompt examples

A prompt before and after improvement, and the part a person does outside the prompt.

Email and agents

Sorting your inbox

Before

“Go through my inbox and deal with anything urgent.”

After

“Go through today’s inbox. Draft replies to urgent messages and save them in Drafts. List separately any email that asks for a payment, a change of bank details, a password or a file.”

Your part

Set the agent to draft-only access if the tool allows it, so the limit doesn’t depend on the prompt. Before acting on any payment request, call back on a number you already have.

Why it works: Draft-only access keeps every outgoing message in your hands, and the separate list catches the emails attackers write.

Research

Researching suppliers on the web

Before

“Research these five suppliers online, then email each one asking for a quote.”

After

“Research these five suppliers on the web and summarize what each offers, with links. Draft a quote request for each, but don’t send them.”

Your part

Give the agent no permission to send email for this task, and read the drafts before you send them. Web pages can carry hidden instructions.

Why it works: Without permission to send email, an agent that reads the open web is missing one part of the lethal trifecta.

Operations and projects

Automating a routine order

Before

“Every Monday, check stock levels and reorder whatever is running low.”

After

“Every Monday, check stock levels and prepare a reorder list for items below the minimum. Orders over €500 or from new suppliers come to me for approval.”

Your part

Set the spending limit in the purchasing system itself, not only in the prompt, and review the first few weeks of orders.

Why it works: Routine, low-value orders can run within limits. The limit only protects you if the system enforces it.

Evidence

  • OWASP’s 2026 Top 10 for LLM applications lists prompt injection and excessive agency among the main risks, and recommends least privilege and human confirmation of privileged, irreversible or externally visible actions. [OWASP]
  • The UK National Cyber Security Centre advises fixed, non-AI limits on what AI systems can do, because prompt injection may never be fully fixed. [UK NCSC]
  • Private data, untrusted content and external communication in one agent make data theft through prompt injection possible. [Willison]
  • NIST defines least privilege as giving each entity the minimum resources and authorizations it needs to perform its function. [NIST]
  • Singapore’s framework for agentic AI prefers approvals enforced by system controls over approvals requested in prompts. [IMDA]

Case studies and scenarios

Team practice

Give every shared agent a permission card: its purpose, what it can reach and do, what needs approval, its limits and who can stop it.

Team toolAgent permission card

Sources

What each source establishes, and its limits. The practices and recommendations on this page are ours, and the facts come from the sources. See every source we use.

  1. OWASP Top 10 for LLM Applications, 2026 edition OWASP Gen AI Security Project · August 3, 2026 · Security guidance Lists the main security risks of AI applications, including prompt injection (LLM01), which it says can’t yet be reliably prevented, and excessive agency (LLM03): more functions, permissions or autonomy than a task needs. Recommends least privilege and human confirmation of privileged, irreversible or externally visible actions. Limits: Community guidance, not a formal standard.
  2. Prompt injection is not SQL injection (it may be worse) UK National Cyber Security Centre · December 8, 2025 · Official guidance Explains that AI models have no reliable boundary between data and instructions, so prompt injection may never be fully fixed, and advises fixed, non-AI limits on what systems can do, least privilege and logging. Limits: Written for security professionals.
  3. The lethal trifecta for AI agents Simon Willison · June 16, 2025 · Practitioner analysis Names the combination of access to private data, exposure to untrusted content and the ability to communicate externally as the condition for data theft through AI agents, and notes that no known technique reliably prevents it. Limits: A practitioner’s framework, not peer reviewed.
  4. Least privilege (glossary entry) NIST Computer Security Resource Center · Definition from NIST SP 800-53 Rev. 5 · Standard definition Defines least privilege as giving each entity the minimum system resources and authorizations it needs to perform its function. Limits: A glossary that compiles definitions from NIST publications.
  5. Model AI Governance Framework for Agentic AI Infocomm Media Development Authority, Singapore · Version 1.5, May 20, 2026 (first published January 22, 2026) · Voluntary framework Keeps organizations and their human supervisors accountable for agents’ actions; asks for human approval at significant checkpoints such as deleting data, sending messages and payments; treats very low override rates and very fast reviews as possible signs of rubber-stamping; prefers approvals enforced by system controls over prompts. Limits: Voluntary guidance, not law. Its case studies were supplied by the companies themselves.

Cite this page

Founderz (2026). Principle 4: Limited permissions for AI agents. The RUAI Standard, 2026 edition. Developed by Founderz in collaboration with Microsoft. https://responsibleai.founderz.com/toolkit/principles/agent-permissions

Licensed under CC BY 4.0: share and adapt with attribution.