For decades, cybersecurity professionals have relied on the principle of least privilege: Only give identities the access needed to perform their jobs. That principle remains essential. But AI agents have exposed its limits.
An AI agent can have exactly the right permissions and still do the wrong thing
Consider an agent authorized to issue customer refunds. Least privilege can constrain which customer records and payment systems the agent can access. But those permissions alone don’t determine how large a refund it can approve, under what circumstances it should act, or whether it can execute thousands of refunds without human review. The problem isn’t necessarily excessive access — it’s excessive agency.
Least privilege primarily constrains access: What resources can this identity reach? AI agents introduce additional dimensions because they can make decisions, invoke tools, pursue objectives, and act with varying degrees of independence. Securing them therefore requires organizations to govern not just access but also authority and autonomy:
- Access: What resources, data, systems, and tools can the agent reach?
- Authority: What decisions and consequential actions can it make using that access?
- Autonomy: How independently can it make those decisions and take those actions?
That’s the idea behind least agency, which Forrester defines as:
Continuous enforcement of the minimum decision-making authority and operational autonomy an AI agent requires to pursue its authorized purpose.
Least agency doesn’t replace least privilege — it extends it
Achieving least agency in practice means continuously constraining and adjusting access, authority, and autonomy to the agent’s purpose and operating context. Too much access creates the familiar risk carried by excessive permissions. But even tightly controlled access paired with excessive authority or autonomy can produce unsafe outcomes. At the same time, constrain an agent too tightly, and it cannot accomplish the objective that made it valuable in the first place.
The challenge is not simply minimizing access but giving an agent enough agency to accomplish its objective and nothing more. That also makes least agency more than an identity and access management (IAM) problem.
Least agency requires integration across security domains, a point emphasized in Forrester’s AEGIS framework for AI security. IAM establishes the agent’s identity, access, and delegation relationships. AI governance establishes its purpose, ownership, accountability, and operating boundaries. Runtime security monitors what the agent is doing and enables controls to adjust or interrupt its actions as context and risk change. Together, these capabilities provide the foundation for continuously determining what an agent can access, what it is authorized to do, and how independently it should be allowed to act.
I’ll be exploring least agency and how security teams can operationalize it in my track session, “From Least Privilege To Least Agency: IAM For Agentic Architectures,” at Forrester’s Security & Risk Forum, taking place this November 9–10 in Washington, DC. And as always, if you’re a Forrester client and want to know more, please reach out and set up an inquiry or guidance session.