AI-powered agents are transforming how we interact with software. From scheduling meetings to managing cloud infrastructure, these autonomous agents are driven by large language models (LLMs) and capable of making their own decisions and actions. But as these agents become more capable, they also pose new challenges in access control and security.

How do you ensure an AI agent doesn’t overstep its bounds? What happens if it tries to modify something it shouldn’t or accesses sensitive data unintentionally?

This article explores how AI agent permissions can go wrong when mishandled using example scenarios and outlines key best practices developers should implement to prevent them.

AI Agent permissions: What's the worst that could happen?

Traditional software typically follows predictable, testable, and mostly pre-determined logic. AI agents, powered by LLMs, are different. They generate actions dynamically based on natural language inputs and infer intent from ambiguous context, which makes their behavior more flexible—and unpredictable. Without a robust authorization model to enforce permissions, the consequences can be severe.

Here’s why proper permission handling and securing AI agents are essential, and where things can go wrong:

1. Unpredictable autonomy

LLMs don’t follow rigid code paths or fixed executions. When granted broad and direct access to tools, APIs, databases, or internal systems, they can perform actions the developer or end user never intended, especially when safeguards like permission scoping or user confirmation are missing.

Consider an enterprise that deploys an AI-powered executive assistant with access to users’ inboxes to help manage scheduling and draft emails.

A manager asks the assistant, “Send a follow-up to Alex with the budget slide deck and key points from the leadership meeting.” The assistant looks through the contact list, selects the first match for “Alex”, an external contractor instead of the intended internal stakeholder, and sends the email with the confidential attachment. Because the assistant had full email-sending privileges, sensitive information was exposed with a single prompt.

Even worse, AI agents with overly permissive access can be exploited by malicious actors—not just through bugs, but through carefully crafted prompts. One of the most dangerous attack vectors is prompt injection, where a malicious prompt is embedded somewhere in the input, causing the AI to either override its original instructions or execute unintended commands.

For example, imagine an AI agent integrated with a plugin system and instructed to query data, encode it, and return a specific format. An attacker could engineer prompts that result in the agent executing a live SQL query, retrieving sensitive user data, encoding it into a URL, and outputting it exactly as requested:

source

This kind of behavior could easily result in the exfiltration of sensitive data, especially if combined with external tools, document plugins, or browser-based agents.

Whether accidental or adversarial, the lesson is the same: AI agents should never be given broad, unsupervised authority to act. Without strict permissions, well-defined scopes, and limited access, their ability to dynamically infer and act can quickly become a liability.

2. Acting on behalf of users

AI agents often operate using delegated credentials—such as OAuth tokens or service identities tied to the user initiating the request—which allows them to act on that user’s behalf.

While this model supports automation, it can introduce significant risks if the agent and user are not clearly distinguished. When the agent and the user are treated identically, it may execute actions that were never intended—even if those actions fall within the scope of the user’s technical permissions.

Consider a scenario where a DevOps AI agent is deployed to help engineers manage infrastructure. To simplify integration, the AI agent operates using the OAuth tokens of the requesting user—meaning it inherits the developer’s identity and permissions directly.

One day, a developer asks the assistant to “clean up old resources.” The assistant interprets this request too broadly and issues a DELETE command that removes a production database replica. Because the agent was treated as an extension of the user rather than a distinct client, there was no opportunity to apply additional safeguards, scope checks, or runtime reviews.

A more secure pattern is to treat the AI agent as its own independent client, with its own OAuth client ID and access token. This way, the agent’s permissions can be explicitly defined, audited, and limited—rather than inherited from whoever happened to prompt it. Without this separation, agents risk inheriting permissions that bypass enforcement layers entirely.

Had the agent instead been issued its own OAuth client ID and access token—separate from the user—it could have been explicitly constrained to perform only non-destructive operations, especially when agents are empowered to act within sensitive or production environments.

3. Security and compliance in regulated industries

In highly regulated industries like finance or healthcare, lax AI agent boundaries can lead to compliance violations, data leaks, or even legal repercussions. AI agents that are operating in multi-tenant systems don’t just need narrowly scoped credentials, they also may require strong runtime controls and execution boundaries to meet regulatory data protection standards like GDPR and HIPAA.

Imagine an AI assistant embedded within a CRM platform used by multiple enterprise customers. The assistant is scoped: it only retrieves data belonging to the currently authenticated tenant and operates under strict API-level access controls.

However, when asked to “generate a summary of common customer issues this month,” the AI agent accesses shared context or global memory and decides to aggregate and compare trends across multiple tenants in order to produce a more “insightful” response. It compiles this data into a report that references patterns seen in multiple client environments and displays it directly in the UI.

In this case, no permission was explicitly violated at the API level—but the runtime behavior of the AI agent violated the platform’s multi-tenant data isolation model. This happened not because of excessive access, but because there were no sandboxing or policy enforcement mechanisms to restrict how the AI processed data once retrieved.

This kind of failure is subtle but dangerous. It’s not a question of “who can access what,” but “what can the AI do with the data it’s allowed to see?”.

In regulated or enterprise environments, this can still constitute a serious compliance breach, despite correct authentication and authorization on paper.

Best practices for AI agent permissions

To safely deploy AI agents in real-world systems, here are some core principles every AI-integrated system should enforce for proper permission management:

Least privilege

AI agents should be granted only the minimum access required to perform their tasks—nothing more. Avoid providing unrestricted credentials, root API keys, or full administrative access. Instead, issue scoped tokens or read-only roles that tightly align with the agent’s intended behavior. For example, if an agent is assisting with support tickets, it shouldn’t have access to billing or administrative APIs.

OAuth scopes and consent

Leverage OAuth 2.0 to define granular access scopes and obtain explicit user consent. Rather than issuing a single token with wide-ranging privileges, define fine-grained scopes such as read_calendar, send_email, or view_contacts. This allows the user (or admin) to control precisely what the AI agent is authorized to do on their behalf.

Leading AI organizations like Anthropic have made OAuth 2.1 a foundational part of the Model Context Protocol (MCP) authorization spec.

Short-lived tokens and revocation

AI agents should never be issued long-lived credentials. Instead, use short-lived access tokens with built-in expiration and refresh mechanisms. In case of suspicious behavior, tokens can be revoked without disrupting the user’s primary session or credentials.

Importantly, tokens should never be exposed inside LLM prompts. The backend service—not the LLM—should handle credential attachment securely at runtime. Treat tokens as sensitive secrets and follow standard credential management best practices, such as storing them in encrypted vaults or using ephemeral session credentials.

Audit logging

Every action an AI agent takes should be logged and traceable, just as if a human user had performed it. Logs should include what was accessed, when, and under which identity and permissions. This provides an essential forensic trail in case of incidents or unexpected outcomes.

Comprehensive logging also supports compliance requirements (e.g., GDPR, HIPAA) and enables proactive monitoring—such as detecting out-of-pattern behaviors or unapproved cross-tenant data references.

Human oversight for sensitive actions

Users should always be able to see what an AI agent has permission to access and do. This can take the form of a consent screen, access dashboard, or detailed activity panel.

Additionally, agents should require confirmation for critical operations by only authorized users. Even the most well-designed AI agent should not operate entirely autonomously when it comes to destructive, irreversible, or sensitive actions.

Securely connecting your apps to AI agents

Implementing the right permission model for AI agents is critical, but actually enforcing those permissions across third-party tools, plugins, and AI models in the broader context of AI agent security can be challenging. Especially in multi-tenant environments or distributed systems, securely brokering access between your app and AI agents requires a lot of engineering infrastructure.

That’s where Stytch’s Connected Apps comes in. Connected Apps allows you to turn your application into a secure OAuth / OIDC identity provider, so you can delegate access to AI agents, external tools, or third-party apps using scoped tokens and consent-driven flows.

With Stytch Connected Apps, you can:

• Issue access tokens for each AI agent with custom scopes and permissions, alongside role based access control.
• Isolate agent identity from end-user identity, so that permissions are explicitly defined rather than inherited from whoever triggered the action.
• Define and enforce consent flows, so users or admins can authorize what agents are allowed to access—down to the specific resource or API endpoint.
• Monitor and revoke access, ensuring that every AI agent session is auditable and controllable.

Stytch handles the complexity of AI agent authentication and authorization flows, so you can focus on building secure AI-powered features without reinventing your auth layer.

Conclusion

AI agents are powerful, but the stakes are high. By following best practices like using OAuth scopes, you can unlock the full potential of AI agents without introducing unnecessary risk.

And if you need a foundation for connecting your applications to AI agents securely, Stytch Connected Apps offers the developer tools to integrate quickly and securely.

Ready to connect your app to AI agents, the right way? Get started with Stytch today.