The case for role-based access control in AI agents

An agent that can read or change anything in a system is a much bigger risk than the human employee it's assisting, because it can act at machine speed and doesn't get tired, distracted, or hesitant about an edge case.

Agents should never have more access than the person they act for

When our CRM agent updates a record on behalf of a sales rep, it operates under that rep's own permissions — not a service account with blanket access to the whole pipeline. If the rep can't see a deal, the agent can't touch it either.

Why "just give the agent admin" is tempting and wrong

It's the fastest way to get a demo working: skip the permission model, let the agent hit every table it might need. It's also how a single prompt injection or bad tool call turns into a full data exposure instead of a contained one.

What this looks like in practice

• Every agent action is scoped to the identity of the human or system it's acting on behalf of.
• Permission checks happen at the same layer as they would for a human user — not bypassed because "it's just an agent."
• Every action is logged against that identity, so an audit trail reads the same way it would for a person.

Scoped access doesn't make an agent less useful. It makes the blast radius of any single mistake — the agent's or ours — something you can actually reason about.