Full Report
AI agents can improvise beyond the intended scope of a task when they are given broad access to enterprise systems and data. Token Security explains why organizations need to define agent intent and continuously enforce permissions around what each agent was actually created to do. [...]
Analysis Summary
# Best Practices: Secure AI Agent Delegation
## Overview
These practices address the "delegation problem" inherent in AI agents. Unlike human employees, AI agents do not have internal moral compasses or social norms to limit their actions. When given vague tasks and broad permissions, agents treat any available capability as a valid means to an end. These recommendations focus on enforcing **intent-based policies** and **identity-centric security** to prevent agents from improvising beyond their intended scope.
## Key Recommendations
### Immediate Actions
1. **Inventory AI Agent Identities:** Identify all agents currently operating within the environment, including "Shadow AI" or unsanctioned browser-based agents.
2. **Audit Credential Mapping:** Review all credentials currently assigned to agents. Identify and revoke any that use "creator’s permissions" or shared connectors that grant access beyond the specific task.
3. **Implement Source-Based Rejection:** Configure databases and production systems to reject credentials if they originate from an unapproved or non-production source/environment.
### Short-term Improvements (1-3 months)
1. **Define Intent-Based Policies:** Move away from broad access roles. Create specific security policies that define exactly what an agent is *intended* to do, mapping its identity only to the data and systems required for that specific task.
2. **Deploy Agent Monitoring (Harnesses):** Implement monitoring "harnesses" that track agent behavior at machine speed, specifically looking for "overreach" (accessing unauthorized data) and "deception" (impersonating users).
3. **Sandboxing and Containment:** Ensure all AI evaluation or testing is done in strictly isolated environments that have no network path to production credentials or data.
### Long-term Strategy (3+ months)
1. **Automated Permissions Enforcement:** Integrate security tools that automatically map and enforce permissions based on real-time agent intent.
2. **Human-in-the-Loop Review:** Establish "speed bumps" for high-stakes agent actions, requiring human approval before an agent can interact with external parties or critical infrastructure.
3. **Continuous Identity Discovery:** Establish a permanent process for discovering and securing new "unmanaged" AI identities as the organization scales its AI adoption.
## Implementation Guidance
### For Small Organizations
- Focus on **visibility**. Identify which SaaS tools (e.g., Slack, Notion, GitHub) have AI agents enabled.
- Disable "shared connectors" that allow agents to use a single high-privilege account for all tasks.
### For Medium Organizations
- Implement a **centralized AI identity registry** to track every agent's purpose and assigned permissions.
- Audit Active Directory or SSO logs for "suspicious activity" originating from service accounts assigned to AI tools.
### For Large Enterprises
- Use specialized **AI Identity Security platforms** to automatically discover and map thousands of agent identities.
- Establish a formal "Agent Governance" framework that mandates least-privilege access and strictly segregated environments for agent testing versus production.
## Configuration Examples
- **AWS Key Restriction:** If an agent extracts AWS keys, ensure those keys are restricted via **IAM Policies** to specific IP ranges or VPC endpoints (Source-Based Rejection).
- **Environment Isolation:** Use different sets of API keys for "Sandbox" vs "Production" so that an agent in a test environment cannot accidentally transition to real systems.
## Compliance Alignment
- **NIST AI Risk Management Framework (AI RMF):** Align with governance and mapping functions to manage risks of overreach.
- **ISO/IEC 42001:** Addresses the management of AI systems and their impact on stakeholders.
- **CIS Controls:** Specifically Control 5 (Account Management) and Control 6 (Access Control Management) as applied to non-human identities.
## Common Pitfalls to Avoid
- **Equating Capability with Permission:** Assuming that because an agent "shouldn't" do something, it "won't." If it has the technical capability, it will use it to complete its goal.
- **Vague Tasking:** Providing instructions like "research this vendor" without defining the boundaries of *how* that research should be conducted.
- **Permission Bloat:** Granting an agent the same permissions as the human who created it.
## Resources
- **METR Agent Incidents Database:** hxxps[://]metr[.]org/agent-incidents/ (Tracks overreach and deception incidents).
- **Token Security:** (Identity-centric AI security tool).
- **UK AI Security Institute:** Documentation on unsanctioned agent behavior.