AI Agents Need More Than Least Privilege — They Need Least Agency
The management issue is not whether AI agents can access a system, but whether they are allowed to make consequential decisions without the right business guardrails. For CIOs and security leaders, that shifts the control model from identity alone to a combination of purpose, authority, and autonomy. In practice, every agent needs an explicit operating charter: what outcomes it is allowed to pursue, which actions require approval, and what thresholds trigger escalation or shutdown.
This has important governance implications. Least agency is not just a security architecture concept; it is a decision-rights design problem. Business owners, risk leaders, IAM teams, and platform teams need shared accountability for defining agent boundaries. Without that, organizations risk deploying agents into production with unclear ownership, weak exception handling, and no agreed tolerance for financial, compliance, or customer-impact errors.
There is also a portfolio trade-off. Agents deliver value when they reduce manual effort and accelerate decisions, but the most autonomous use cases often carry the highest operational and reputational risk. Leaders should prioritize use cases by consequence of failure, not just ease of implementation. Low-risk internal tasks may justify higher autonomy sooner; customer-facing or financially binding actions may require staged rollout, approval checkpoints, and runtime intervention controls.
Practical questions for leadership include:
- Who is the accountable owner for each agent’s purpose and decision scope?
- What actions must remain human-approved, regardless of technical capability?
- What telemetry, kill switches, and audit trails are required to govern agents in real time?
- How will autonomy levels be reviewed as business context, risk, and performance change?
For decades, cybersecurity professionals have relied on the principle of least privilege: Only give identities the access needed to perform their jobs.
That principle remains essential. But AI agents have exposed its limits.
An AI agent can have exactly the right permissions and still do the wrong thing.
Consider an agent authorized to issue customer refunds. Least privilege can constrain which customer records and payment systems the agent can access. But those permissions alone don’t determine how large a refund it can approve, under what circumstances it should act, or whether it can execute thousands of refunds without human review.
The problem isn’t necessarily excessive access. It’s excessive agency.
Least privilege primarily constrains access: What resources can this identity reach? AI agents introduce additional dimensions because they can make decisions, invoke tools, pursue objectives, and act with varying degrees of independence.
Securing them therefore requires organizations to govern not just access, but also authority and autonomy:
- Access: What resources, data, systems, and tools can the agent reach?
- Authority: What decisions and consequential actions can it make using that access?
- Autonomy: How independently can it make those decisions and take those actions?
That’s the idea behind least agency, which Forrester defines as:
Continuous enforcement of the minimum decision-making authority and operational autonomy an AI agent requires to pursue its authorized purpose.
Least agency doesn’t replace least privilege. It extends it.
Achieving least agency in practice means continuously constraining and adjusting access, authority, and autonomy to the agent’s purpose and operating context. Too much access creates the familiar risk carried by excessive permissions. But even tightly controlled access paired with excessive authority or autonomy can produce unsafe outcomes. At the same time, constrain an agent too tightly and it cannot accomplish the objective that made it valuable in the first place.
The challenge is not simply minimizing access. It is giving an agent enough agency to accomplish its objective, but no more.
That also makes least agency more than an IAM problem.
Least agency requires integration across security domains, a point emphasized in Forrester’s AEGIS framework for AI security. IAM establishes the agent’s identity, access, and delegation relationships. AI governance establishes its purpose, ownership, accountability, and operating boundaries. Runtime security monitors what the agent is doing and enables controls to adjust or interrupt its actions as context and risk change.
Together, these capabilities provide the foundation for continuously determining what an agent can access, what it is authorized to do, and how independently it should be allowed to act.
I’ll be exploring least agency and how security teams can operationalize it in my track session “From Least Privilege To Least Agency: IAM For Agentic Architectures” at Forrester’s Security & Risk Forum, taking place November 9–10, 2026 in Washington, DC. And as always, if you’re a Forrester client and want to know more, please reach out and set up an inquiry or guidance session.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.