AI Agent Permissions: Why Your Agents Need Their Own Login, and How to Scope It

The short answer

AI agent permissions should belong to the agent, not to the person who set it up. Give each agent its own credentials, the narrowest access its job needs, a named human owner, and a way to switch it off. Sharing your own login with an agent makes every mistake look like yours and gives it far more reach than it needs.

Most small businesses connect their first AI agent the quick way: sign in with the owner's Google or Microsoft account, click "allow" on every scope, and move on. It works. It also hands a piece of software the keys to everything that account can touch, including payroll folders, the client list and the admin console. As agents start running unattended, that shortcut is becoming the most common security gap we see in small-business AI setups.

Why AI agent permissions are suddenly a big deal

Agents now act, not just answer. They send emails, update records and click through websites. Large vendors have noticed. On October 15, 2026, ServiceNow announced AI Passport, which it describes as "a cryptographically signed credential that AI agents refer to at runtime." Each agent gets its own passport defining what it is authorised to do, delegated permissions narrow at each step of a workflow, and an agent that drifts out of scope can be redirected, restricted or stopped with a kill switch. ServiceNow says AI Passport is expected to be available in Q4 2026, so treat it as an announced product rather than a proven one.

Microsoft took a similar path with Microsoft Entra Agent ID, which gives agents identity accounts that are separate from human users and ordinary apps. Microsoft's documentation lists the reasons plainly: to distinguish what agents do from what people do, to give agents "right-sized access," to keep them away from the most critical security roles, and to retire them "without leaving orphaned credentials."

You don't need enterprise software to apply the same ideas. You need the principles.

The problem with letting an agent use your login

• Too much reach. Your account can see everything you can. An agent that only needs the shared inbox doesn't need your bank statements.
• No audit trail. When the agent sends an email or deletes a file, the log shows your name. You can't tell your actions from its actions.
• No clean off switch. Revoking the agent's access means changing your own password or hunting through connected-app settings.
• Bigger blast radius for attacks. If a malicious web page or email tricks the agent, it acts with your full authority. We explain how that happens in our guide to prompt injection.

The OWASP Gen AI Security Project names this risk Excessive Agency and traces it to three root causes: excessive functionality, excessive permissions and excessive autonomy. Its key recommendation is to "implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not." In plain terms: don't ask the AI to police itself. Make the systems it connects to refuse what it shouldn't do.

What "its own identity" means in practice

For a small business, an agent identity is usually one of three things:

Option	What it looks like	Good for
Dedicated service account	A separate user such as agent-intake@yourcompany, with its own licence and limited group membership	Agents that need email or calendar access
Scoped API key or OAuth app	A key or app registration that grants only specific actions, for example "read contacts, create notes"	CRM, accounting and booking integrations
Platform agent identity	A built-in identity such as Entra Agent ID or a vendor's agent account	Businesses already on Microsoft 365 or similar suites

Whichever you use, it should have an owner. Microsoft calls this a sponsor: the person or group accountable for the agent. If nobody owns an agent, nobody will notice when it misbehaves or when it should be retired.

How to scope AI agent permissions in five steps

1. Write the job description first. One sentence: "This agent reads new website enquiries, drafts a reply and creates a lead in the CRM." Every permission must trace back to a verb in that sentence.
2. Create a separate identity. A service account, a scoped API key or a platform agent identity, never a person's login. Name it so logs are obvious.
3. Grant the minimum scopes. Read-only where possible. If it must write, limit it to specific objects (create notes, not delete contacts). OpenAI's security guidance for plugin builders says the same: request only the scopes you need, and "verify and enforce scopes on every tool call."
4. Put approvals on irreversible actions. Payments, deletions, permission changes and messages to customers should wait for a person. The same OpenAI guidance recommends "requiring human confirmation for irreversible operations." Our guide to human-in-the-loop design covers where those checkpoints belong.
5. Log, review, retire. Check the agent's activity monthly. Rotate keys on a schedule. When the job ends, delete the identity rather than leaving it dormant.

A quick audit for agents you already run

Spend 30 minutes on this list. If you answer "no" to any item, fix that first.

• Does every agent or automation have its own credentials, separate from any employee?
• Can you name the person responsible for each one?
• Can you revoke any single agent's access without affecting a human account?
• Are admin, billing and payroll systems excluded from every agent's scope?
• Do your logs show which actions an agent took versus a person?
• Have you removed access for tools and pilots you no longer use?

For more on where data flows once an AI tool is connected, see connecting AI to your business data safely. If agents are already operating on your behalf around the clock, our explainer on always-on AI agents covers the controls specific to that setup.

Key takeaways

• Never let an agent run on a person's login; give it its own identity and an accountable owner.
• Scope AI agent permissions to the verbs in the agent's job description, starting read-only.
• Enforce limits in the systems the agent connects to, not in the agent's instructions.
• Require human approval for anything irreversible, and retire identities when the job ends.

Frequently asked questions

Do I need special software to give an AI agent its own identity?

Not usually. A dedicated user account or a scoped API key in each connected tool covers most small-business cases. Platform features such as Microsoft Entra Agent ID add central management if you already use that ecosystem.

Is it safe to give an agent admin access temporarily during setup?

Avoid it. Set up integrations with an admin account yourself, then hand the agent a limited identity. Temporary admin access has a habit of becoming permanent.

What is ServiceNow AI Passport?

It is a signed credential, announced on October 15, 2026, that defines what each AI agent may do and lets enforcement systems check it at runtime. ServiceNow expects it to be available in Q4 2026.

Sources

1. ServiceNow advances its operational harness for enterprise AI with AI Passport and expanded governance capabilities — ServiceNow Newsroom, October 15, 2026
2. What are agent identities? - Microsoft Entra Agent ID — Microsoft Learn
3. LLM06:2025 Excessive Agency — OWASP Gen AI Security Project
4. Security & Privacy — OpenAI Plugins documentation

How Flowmatix can help

We put this into practice for businesses in Toronto and around the world through our AI Agents & AI Solutions, cybersecurity, api development & integration services. Want to know what it would take for your business? Get a personalised quote in about 3 minutes.