Production AI agents need action permissions at the tool boundary

An agent that summarizes a support case is useful. The same agent with permission to change an account, issue a refund and send an email has a different risk profile. A recent practitioner discussion asks how teams handle permissions for production agents. The concern is not whether a model is “safe” in the abstract; it is what the connected tools will execute when the model asks.

List every possible side effect

Inventory tools by read, create, update, send, delete and financial effect. Record the data scope and the identity used. A single service account with all permissions may be convenient for a prototype, but it makes it difficult to enforce a user's actual authority or investigate a bad action. OWASP's excessive agency guidance names excessive functionality, permissions and autonomy as separate failure modes.

Enforce policy in code around each tool

The tool should validate the actor, target, amount, resource scope and required approval when the action is requested. Do not rely on a system prompt as the authorization layer. Use separate read and write capabilities; grant only the operations a workflow needs. Bind a human approval to the exact proposed action and parameters, then revalidate before execution. “The user approved the conversation” is too vague for a high-impact action.

Microsoft's agent security guidance is a useful product reference for identity, data access and operational controls. The design still needs the organization's own authority model: who may request a change, who approves it, and what evidence survives an incident.

Test denial as carefully as success

Try a user who lacks permission, an agent that changes target after approval, a prompt injection inside retrieved content, and a retry after a partial failure. Record the tool decision, approval ID, executed parameters and result. Make replay or recovery safe for non-idempotent actions.

Adovo’s view

An agent's real authority is the set of doors its tools can open. Give it only the doors needed for the task, and keep a person at the threshold when an action carries consequence. Autonomy becomes valuable after authority is made precise. Before that, it is merely speed applied to uncertainty.