agentic AI and over-access

An AI agent is a system that takes actions autonomously, often in sequence, to complete a task. Unlike a conversational AI tool that generates text for a human to act on, an agent acts directly. It sends emails, creates calendar entries, writes and executes code, interacts with files, calls APIs, and performs tasks in connected business applications.

Agents operate with a set of permissions. Those permissions are typically granted either at the user level (the agent acts with the credentials of the user who set it up) or at an application level (an OAuth grant that defines what the agent can access).

Over-access in agentic AI means the agent holds permissions that exceed what its designated tasks require. An agent that was set up to draft email responses holds read and write access to the user's entire mailbox. An agent that was set up to summarize documents holds access to the entire file storage system. Least privilege was not applied. The gap between task scope and permission scope is the risk.

The over-grant is rarely a decision anyone made consciously.

OAuth scopes are often granted in bulk. When an employee connects an AI agent to work systems, the authorization flow presents a list of requested scopes. Most users accept what is requested. The agent then holds those scopes whether or not it ever needs them all.

The access request is made by the vendor, not negotiated by IT. AI vendors configure the default OAuth request for their product. A vendor that defaults to requesting broad access will receive broad access from every user who connects the tool without IT intervention.

Agents are deployed by enthusiastic users, not by IT. Many AI agents in enterprise environments were set up by people outside of IT who found a useful workflow. They did not assess the access implications before deploying. The governance question was not raised because IT was not in the room.

The blast radius of an AI agent operating with over-access is bounded by its permissions. That boundary is often much wider than the intended use case.

Accidental actions. An agent instructed to "clean up my inbox" but granted full mailbox write access might delete or archive emails the user wanted to keep. An agent instructed to "schedule my meetings" with calendar write access might modify or cancel existing meetings. Autonomy plus over-access plus imprecise instructions produces unpredictable outcomes.

Exploitation through prompt injection. An agent that processes external content (emails from outside parties, web pages, documents) and holds broad permissions is a prompt injection risk. Attacker-controlled content that reaches the agent can include instructions to take actions with the agent's full permission scope.

Credential and data exposure. An agent that holds read access to a full mailbox or document system holds access to everything in those systems. If the agent's connection is compromised, or if the agent itself leaks data through its external model connection, the exposed data set is the full scope of what it can reach.