CISO Guide to Agent Least Privilege

Least privilege for AI agents is not “turn down the model temperature.” It is narrowing what the autonomous actor may do on the system — independently of the human who launched the session.

Executive framing

• Agents are a new actor class — Same laptop, same login, different authority requirements.
• Governance without enforcement is inventory — Catalogs and policies do not block read ~/.ssh at attempt time.
• Evidence beats policy debates — Audit Mode on a real developer cohort produces board-ready exposure themes.

Principles

1. Assume agent manipulation — Prompt injection is a when, not an if; boundaries must hold anyway.
2. Enforce at the action — Shell, MCP, file, API, browser automation on the machine where execution happens.
3. Default deny for high-impact classes — Credential reads, destructive cloud/k8s, unknown egress — unless explicitly scoped.
4. Human ≠ agent — Alice may read a break-glass key; Claude Code on Alice’s session should not.
5. Local decisions for local actions — Air-gapped and regulated environments cannot depend on cloud approval per tool call.

Operating model (90 days)

Phase	Duration	Outcome
Exposure assessment	Days 1–14	Telemetry-backed map of agent reach
Boundary design	Days 15–30	Actor-scoped policy aligned to risk
Audit → Prevent	Days 31–60	Progressive enforcement on pilot cohort
Expand + SIEM	Days 61–90	Enterprise rollout with decision evidence

Metrics that matter

• Credential-path attempts by autonomous actor (blocked vs would-have-been-allowed in audit)
• MCP → shell bridges detected
• Production-adjacent commands attributed to agent vs human
• Policy precision — false positive rate on blocked dev workflows

Common anti-patterns

• Prompt filtering as primary control — Necessary for some abuse classes; insufficient for system authority.
• Agent inventory only — You cannot least-privilege what you never measure at action time.
• Banning IDEs — Developers route around; enforcement preserves velocity with boundaries.

Relationship to IAM and EDR

• IAM supplies identity context for policy inputs.
• EDR correlates threat signal with agent decision telemetry.
• Agent control answers authorization at execution — the gap IAM and EDR were not designed to own alone.

---

Start with the AI Agent Exposure Assessment. Technical architecture: /technical.