Book an initial call
Book an initial call

The challenge

AI agents without an authorization concept

An AI agent is given a goal and picks its own tools. An authorization concept modeled on service accounts assumes fixed actions that an agent does not have.

Book an initial call

The challenge

Where AI agents become a problem

  • Excessive permissions

    Nobody knows in advance which tools an agent will call. So it gets everything it might need, and least privilege becomes guesswork.

  • Borrowed identities

    If an agent runs under the account of the person who started it, only that person shows up in the log. What the agent decided on its own is no longer visible.

  • Hidden instructions

    An agent reads emails, documents and tickets. If one contains a hidden instruction, the agent may execute it like a legitimate task. This is known as prompt injection.

  • Shadow agents

    Employees build agents in tools such as Copilot Studio without IT knowing. These agents do not appear in any inventory.

  • Impact

    No authorization concept

    Authentication establishes who the agent is. It does not tell you whether its next action is allowed.

    • Excessive permissions on every run
    • No distinction in the log between the agent and the person it acts for
    • Hidden instructions get executed
    • Payments and payouts without approval per action
    • Unknown agents with access to customer data
  • Our approach

    Least privilege for agents

    Like any employee, an agent only gets the access its task requires. Because it chooses its tools while it works, four control points decide on every action whether it is allowed.

    • A dedicated identity with short-lived, key-bound credentials
    • Autonomy level per system and data classification
    • A catalog of permitted operations
    • Task-scoped access for minutes
    • Human approval per action for payments, permissions and deletions
Service accountActions are known at provisioning.reads table Areads table Bwrites table CNightly batch jobLEAST PRIVILEGE CAN BE CALCULATEDAI agentActions are decided at runtime.Goal: resolve a complaintMailboxCustomer recordPaymentsTicketing systemKnowledge baseDocument repositoryAgentRun 1Run 2Run 3ITS TOOLS ARE ONLY KNOWN AT RUNTIMEService accountActions are known at provisioning.reads table Areads table Bwrites table CNightly batch jobLEAST PRIVILEGECAN BE CALCULATEDAI agentActions are decided at runtime.Goal: resolve a complaintMailboxCustomer recordPaymentsTicketing systemKnowledge baseDocument repositoryAgentRun 1Run 2Run 3ITS TOOLS ARE ONLYKNOWN AT RUNTIME

Results

What clear rights for agents achieve

  • Complete audit trail

    The log always shows the agent and the person it acts for. An end-to-end correlation ID makes every action traceable.

  • Task-scoped access

    The agent receives access for the duration of a task and returns it afterward. Nothing is granted in advance.

  • Every action checked

    Task, data, tool and output are checked separately. An instruction found in a document does not count as a task.

  • Audit-ready under DORA

    Every layer of the control model maps to a provision of the DORA RTS, in Articles 12, 20 and 21.

Abstract digital network icon

Approach

From inventory to pilot

Policycentral11Taskinput and instructiontask fits the purposeignore instructions in data22Datawhat the agent readsapproved sources onlyfilters per row, column, document33Toolwhat the agent doesoperation in the catalogapproval per action for payments44Outputwhat leaves the agentclassify the outputverify the recipientTarget systemAI agent
  1. 01

    Inventory

    An inventory of all agents with purpose, owner, target systems and last use, including agents built by employees.

  2. 02

    Define autonomy levels

    For each system and data classification, we define whether an agent may observe, recommend or act with approval.

  3. 03

    Operations catalog and delegation

    For every agent we define which operations it may perform and on whose behalf it acts.

  4. 04

    Set up control points

    A central policy decides on task, data, tool and output. Enforcement happens close to the tool.

  5. 05

    Pilot and evidence

    One use case covering all six layers of the control model, then access reviews of agent permissions and a tested shutdown.

Ready for the next step

Talk to us about your AI agents

Tell us briefly about your project. We will get back to you and discuss where your IAM stands today.

    Thank you for your inquiry.

    Your message has been sent successfully. Our team will get back to you shortly.