How do you enforce least privilege for AI agents?

All answers emphasize restricting AI agent access to only what is necessary, though some focus on permissions, others on toolkits, intent, or asset-level controls.

6 answers

Answers

  • James J Azar

    Chief Information Security Officer · Artera Services

    Grant Only Necessary Permissions

    James J Azar says AI agents should receive only the permissions necessary to perform their defined functions, describing this as least-privilege access to tools and data.

    CISO Talk by James Azar · CISO Talk by James Azar · Read

  • Ric Smith

    President of Products and Technology · Okta

    Grant Only Needed Toolkits

    Ric Smith says his team enforces least privilege by making sure agents only have access to certain toolkits, and by taking the grants of the human and activating them for the agent when it acts on that human's behalf.

    TechCrunch · Watch on YouTube

  • Michael Jenkins

    C.T.O. · Threatlocker

    Zero Trust

    Michael Jenkins says his company uses a Zero Trust policy and ring fencing AI—limiting what it can do from the start and deciding as a company what it may access—because AI shouldn't do everything it can.

    Enterprise Security Weekly (Audio) · Enterprise Security Weekly (Audio) · Listen at 14:46

  • Heather Ceylan

    SVP & Chief Information Security Officer · Box

    Limited Permissions

    Heather Ceylan says firms need limited permissions, arguing model guardrails help but are not enough to keep risks at bay.

    Exponential View · Exponential View · Read

  • Mayank Choudhary

    EVP & GM, Information Protection, Cloud Security & Archiving Groups · Proofpoint

    Intent

    Mayank Choudhary says the first of two basic things is intent — understanding why a human or AI is trying to access something in the application or data layer — with the second being what they can touch.

    SiliconANGLE theCUBE · Watch on YouTube

  • Lou E.

    Federal CTO · ColorTokens Inc.

    Focus on Asset-Level Permissions

    Lou E. says least privilege for AI agents means focusing more at the asset level, so they can’t jump out of the sandbox and perform functions on other servers like finance.

    Fed Gov Today · Watch on YouTube

More Information Technology (IT) questions

View all →