An AI agent can act, but with which permissions

An agentic system can use tools to pursue a task, such as reading a document, preparing a reply or performing an operation. Autonomy depends on exposed functions, permissions and approval requirements.

Hypothetical example: drafting an email and sending it without confirmation are different powers, even when the interface looks similar.

OWASP describes excessive agency through excessive functionality, permissions or autonomy. A misunderstanding becomes more consequential when the system can modify, delete or transmit information.

Least privilege means exposing only what the task needs and enforcing controls independently of the model's generated text.

OWASP distinguishes direct and indirect prompt injection. With indirect injection, external content encountered during a task attempts to redirect the system.

A webpage, attachment or search result should not acquire the authority of the user's instructions. Telling a model to ignore malicious text is not a sufficient guarantee on its own.

A tool restricted to public documents does not have the same exposure as one connected to internal files, email or payment operations. Evaluate the data it can reach and the changes it can make.

Logs, action limits and access revocation become operational requirements. CNIL recommends defining use cases and governance before deploying generative AI.

For a pilot, read-only access or draft preparation may meet the need. Require meaningful approval for sensitive actions, showing the recipient, content and scope.

Test errors, misleading documents, cancellation and access removal. More autonomy is not automatically more value.