Agents end up over-privileged through a dynamic nobody chose: a wide scope is issued during development and never revisited, because revisiting it carries a certain cost against an uncertain one. What the blast radius actually is, why intent is not a control, and what bounds it.
Nobody decided this
The scope was wide during development because narrowing it was a distraction from getting the thing working at all.
Then it worked. And once it works, tightening the credential means possibly breaking something that currently earns its keep, in exchange for preventing something that has not happened.
That trade is made every time, by reasonable people, and it always goes the same way. The cost of narrowing is immediate and lands on the person doing it. The cost of not narrowing is deferred and lands on somebody else.
This is why over-privilege is the normal state rather than an unusual lapse.
The blast radius is a list
And it is a list almost nobody has written down.
It is the union of every tool the agent can call, every credential it holds, every network destination it can reach, and everything reachable from those in turn. Nothing about it is mysterious.
Writing it out takes an afternoon. Most teams who do it are surprised by the length, which is the point — the surprise is the finding. You cannot have been managing a number you had not calculated.
Intent is not a control
The agent will only do what we asked it to describes a hope about behaviour, not a property of the system.
The agent does what its input leads it to do, and its input includes material it was asked to read. A component that cannot reliably distinguish an instruction from a document is not made safer by anybody's confidence about its instructions.
Capability and authorisation are different things, and the gap between them is where this lives. The agent is capable of anything its credentials permit. What it is authorised to do is a claim about intent that the runtime does not enforce.
Only one of those two is checked at the moment an action occurs.
What bounds it
Scoped, short-lived credentials, issued per task. A token good for one mailbox for ten minutes limits the damage in advance, without depending on anybody noticing anything. This is the measure that does the most and is felt the least.
An enumerable allow-list of actions. A list can be read, argued about and shortened. Whatever it needs cannot be any of those things.
An owner for the scope, named in writing. Over-privilege persists because narrowing is nobody's job. Give the list a name against it and a date, and the deferred cost acquires somebody to bear it.
Unattended is the word that matters
An agent a person is watching is bounded by that person's attention.
The configurations that go wrong are the ones that run to a schedule, at night, against a queue, with the output reviewed in aggregate the following week — if at all. Autonomy is not the risk. Autonomy plus latency between the action and anybody noticing is the risk.
That latency is measurable and almost never measured. How long between this agent doing something and a human being in a position to see it? If the honest answer is days, then the permissions need to be sized for what a mistake can do in days.
Close
The permissions were set once, quickly, to make something work.
They are still set that way. That sentence is true of more systems than anybody would like, and checking whether it is true of yours takes an afternoon.