Method · Identity and authority

Least-agency access review for AI agents

Least privilege limits accessible resources. Least agency also limits the objective, choices, duration, delegation, and side effects an AI agent may pursue.

Enterprise

Published August 1, 2026Updated August 1, 2026Reviewed August 1, 2026By LongTermIntelligence.com

Direct answer

What is a least-agency access review?

A least-agency access review determines the minimum objective, context, data, tools, permissions, duration, budget, delegation rights, and side effects an agent needs for one bounded task. It also defines prohibited actions, authority checkpoints, evidence, expiration, and revocation.

Do not give a general-purpose agent standing access because one workflow may need it.
Prefer task-scoped and short-lived credentials.
Separate the ability to propose an action from the authority to execute it.

Source basis: reviewed synthesis of the strategy corpus. Report-derived claims remain subject to the verification boundary in the source library.

Reference diagram

From capability to authorized action

The review narrows a broadly capable model into a task-scoped actor whose action still passes policy and authority checks.

A diagram showing objective, context, identity, policy, authority, execution, and evidence boundaries around an AI agent action. — Least agency complements—not replaces—standard identity, network, application, and data security.

Decision table

Review dimensions

Each dimension should end with a decision, owner, expiry, and evidence link.

Dimension	Questions
Objective	What exact task may the agent pursue, and what adjacent goals are prohibited?
Context	Which information is necessary now, and what must remain isolated or redacted?
Identity	Is the identity unique, attributable, task-scoped, and short-lived?
Data	Which records, fields, classifications, regions, and time ranges may be read or written?
Tools	Which operations are permitted, with which arguments and rate limits?
Side effects	May the agent create, modify, delete, publish, purchase, communicate, or commit?
Delegation	May it create sub-agents, call another agent, or pass credentials and state?
Budget and time	What token, money, compute, step, and wall-clock limits apply?
Authority	Which actions require review, dual control, named approval, or are never allowed?
Evidence and revocation	What is logged, when does access expire, and how is it stopped immediately?

Editable resources

Download the least-agency review

Use the CSV during architecture, IAM, security, procurement, and release reviews.

CSV worksheet

Least-Agency Access Review

A CSV worksheet for objectives, data, tools, permissions, side effects, delegation, budgets, authority, evidence, expiry, and revocation.

Download CSV

Templates are planning aids. They are not certifications, legal advice, security guarantees, or substitutes for client-specific validation.

Next step

Reduce standing capability to bounded agency

Review one agent identity and replace broad, persistent access with task-scoped permissions, evidence, expiration, and authority boundaries.

Evaluate readiness Explore services

Least-agency access review for AI agents

What is a least-agency access review?

Least-Agency Access Review

Continue the decision path

AI agent security

Human authority framework

Agentic system card

Reduce standing capability to bounded agency