Your AI Agents Are Guessing at Scale: Permissions Decide the Damage

Summary

AI agents, designed to improvise and adapt, pose a growing security risk when granted broad permissions. Traditional security models struggle to manage these agents because their unpredictable actions cannot be secured by simply filtering inputs or outputs. The article emphasizes the need for intent-based access controls and least privilege principles to manage agentic AI safely.

Full text

Your AI Agents Are Guessing at Scale: Permissions Decide the Damage Sponsored by Token Security July 29, 2026 10:02 AM 0 Watch an agent work through a task, and you’ll see the future of enterprise security. Watch Claude work through a long task some time. It can spend 4 minutes trying to read a CSV that turned out to be a folder, give up, write a script to list its contents, and then get there. It works. Just never the way you sketched it in your head. That is guessing at scale, and it is not a flaw. It’s how LLMs work and why they’re so effective. Agents reason probabilistically, choosing the next best action, observing the result, and adapting. That loop is what makes them powerful, but it is also why security models built around predictable workflows break down. AI agents are designed to improvise; that is what makes them useful. But when improvisation is paired with broad access, every wrong turn becomes a security risk. So here is the question: How do you secure a system whose next move you cannot predict? The Questions Nobody Wants to Answer Every team deploying agents runs into the same access decisions, usually without noticing: Do you give an agent every tool that might help, or only the ones it will probably need? Do you grant admin authority because some edge case could call for it? Do you provision agents with broad access, or scope it down to the specific request in front of the agent right now? Are all of these connectors needed? Which need admin access? Are they needed for every session? None of these has a clean answer, because applying least privilege is hard. Doing it for every agent, and then for every session that agent runs, is orders of magnitude harder. So teams do the human thing by granting full access and moving on. Broad permissions are the path of least resistance, and agents inherit them by default. Most teams cannot answer these questions, because nobody has the inventory. Token Security finds every agent running in your environment, the identities behind it, and the access each one holds. Secure AI By Design Shadow AI and agent sprawl are outpacing your security team's ability to handle them. Token Security discovers every agent, maps risky access, and automatically enforces intent-based policies. Scale AI safely without losing control or slowing down innovation. See it in action Why the Usual Playbook Fails For two years, most AI security efforts went into shaping how models respond. Guardrails that include prompt filtering, input and output constraints, and behavior controls. While these are useful in many contexts, they are the wrong layer for the problem in front of us. Prompt filters try to constrain behavior. With natural language as the interface and an infinite number of possible prompts, there is always another way in. Filtering that works ninety-nine percent of the time still fails, because one percent of infinity is still infinity. More importantly, guardrails operate after access has already been granted. Once an agent holds credentials to a production system, the security boundary is already behind it. A filter can shape what the agent says, but cannot undo what the agent is allowed to do. Prediction fails for the same structural reason. Traditional identity and access management answers one question: what can this identity reach? That model is less useful for AI agents. Two agents with identical permissions can behave completely differently depending on what each is trying to accomplish. You cannot secure a goal-driven system by profiling its past behavior, because its next action depends on contexts it has not yet encountered. Why This Is Urgent Now The scale has already arrived. Palo Alto Networks puts the ratio of non-human identities to human identities at 109 to 1, including 79 AI agents. Agents are accelerating that curve, because anyone can spin one up in minutes, and most do so outside any security review. Think of agent risk as access multiplied by autonomy. Access sets the blast radius, while autonomy narrows the window for human intervention. Static IAM policies, written for humans who log in during business hours and get reviewed once a quarter, were never designed for agents that never sleep, don’t use MFA, and are rarely retired. Identity Is the Only Control Plane That Holds Strip away the model, the prompt, and the framework, and one thing stays constant: every action an agent takes runs through an identity. It authenticates with a service account, an API key, an OAuth grant, a cloud role, or a token. All actions, from reading data to modifying infrastructure, depend on the permissions of an agent’s identities. That is why identity, not prompt filtering, is the control plane for agentic AI. Identity is the layer that spans every system an agent touches, making it the only place you can enforce control consistently. Identity controls access, and intent makes that access safe. Intent Is the Missing Dimension Traditional access control asks what an identity can do. For agents, that is not enough, because purpose is what separates safe behavior from dangerous behavior. An agent resolving a failed deployment and an agent exfiltrating data may perform nearly identical low-level actions: reading logs, calling APIs, and accessing a database. From an IAM perspective, they look the same, but their intent is not the same at all. Intent-based security adds that missing context. Instead of asking "what can this agent access," you ask "what should this agent be able to access to accomplish its purpose, and nothing more." Once intent is defined, permissions can be tightly scoped, and anything outside that boundary stops being a routine anomaly and becomes a security signal worth acting on. This is also the only version of least privilege that survives contact with reality. You cannot hand-tune permissions for every agent and every session. You can, however, model each agent's intent and automatically enforce access controls against it. That is the shift that makes least privilege operational instead of aspirational. Visibility Is Table Stakes. Enforcement Is the Point. Most tools stop at visibility. An inventory of agents is necessary, but it does not change what an agent is allowed to do. Knowing you have a problem is not the same as fixing it, and users will keep granting as much access as they can to get their work done faster. The work that actually reduces risk is preventative and continuous: Discover every agent and the identities it uses, across cloud, SaaS, endpoints, and AI platforms, including the shadow agents nobody registered. Understand what each agent can access and what it is meant to do, so you can right-size permissions to intent. Enforce that scope automatically, revoke access when an agent is retired, and govern the full lifecycle from creation to decommissioning, because risk does not appear at creation. It accumulates as access piles up and ownership blurs. Agents guess. That is their nature, and it is not going to change. What you can change is the blast radius of a wrong guess. You do that at the identity layer, scoped to intent, and enforce it before the action rather than explain it after. Your agents will keep improvising. The question is whether they are improvising inside boundaries you set, or boundaries you never drew. To learn how to secure AI agents at scale, demo Token Security today. Sponsored and written by Token Security.

Entities