Signals · AI security
Did you just give global admin rights to your artificial intelligence?
You wouldn't give a new employee Global Administrator on day one. AI agents deserve the same restraint.
By Gouresh Kamble, Amon Dîn · · 2 min read
Much of the discussion around agentic AI focuses on capability. Less attention is paid to authority.
Modern AI agents are beginning to interact with email platforms, customer databases, financial systems and development environments. Access to those systems should be treated no differently from access granted to any employee. Identity, privilege and accountability remain the foundations of security, regardless of whether the actor is human or machine.
Identity
Every AI agent should have its own identity. Shared administrator accounts were a poor idea before AI arrived, and they have become an even greater liability now. Individual identities make permissions manageable and actions attributable.
Least privilege
Privilege should be granted sparingly. Reading an inbox does not imply the ability to delete messages. Viewing customer information should not include permission to issue refunds. Access should reflect the task, nothing more.
Access should reflect the task, nothing more.
Human approval
High-impact operations deserve additional scrutiny. Financial transactions, production changes and destructive actions should remain subject to human approval until organisations have absolute confidence in the controls surrounding autonomous systems.
Visibility
Visibility matters just as much as access. Every prompt, tool invocation and resulting action should be logged, allowing security teams to understand what occurred, why it occurred and whose authority was exercised.
Ongoing review
Deployment is only the beginning. Permissions change, credentials expire and new attack techniques emerge. Regular reviews, credential rotation and testing against prompt injection are essential if AI agents are to remain trustworthy over time.
The organisations that succeed with agentic AI will not necessarily be those deploying the largest models or the newest tools. They will be those that apply the same discipline to AI identities as they already do to human identities.
AI agents are becoming part of the workforce. Amon Dîn can help ensure they are governed as carefully as the people they work alongside.