A role describes a job, and an agent has a task. Organisations give agents the permissions they built for staff, because those are the permissions they have. A role assumes a person who applies judgement about what falls outside it, and an agent applies no such judgement. This article explains why a service account is the wrong unit, what a capability gives you instead, and the four rules that decide whether a permission model holds at machine speed.
Connect with us about agent permissions · · Replies within 24 hours
Exactly the permissions its current task needs, and no more. Each grant should name one action on one defined scope, and it should expire or be revocable at once.
That answer sounds obvious, and almost no estate implements it. The reason is practical. Your systems hold roles, and a role is the only unit available, so the agent receives a role.
A role encodes a job description. A housing officer may read tenancy records, update a repair, and raise a payment. Those three abilities travel together, because the person needs all three across a working week.
A person also carries a boundary that the role does not state. The officer knows not to read the record of a neighbour, a colleague or a relative. Nothing in the permission model prevents it, and the person does not do it.
An agent holds the same three abilities and none of the boundary. It reads what the task appears to need, and it does that at machine speed.
A service account exists to let software run without a person. It usually holds broad permissions, because narrowing it breaks something and nobody knows what.
Three properties make it the wrong home for an agent.
The Cloud Security Alliance describes the wider problem in a research note on the AI agent governance framework gap, published in April 2026.
A capability is a grant that states one action on one scope. Read this resident's care plan. Update this repair job. Not a role, and not an account.
| Property | A role | A capability |
|---|---|---|
| Unit | A job description. | One action on one scope. |
| Duration | Until somebody changes it. | The task, or a stated period. |
| Change over time | It accumulates. | It narrows, and never widens. |
| Withdrawal | A ticket and a deployment. | Effective on the next call. |
| Evidence of use | Sometimes a log entry. | Every use is an event. |
Singapore's Model AI Governance Framework for Agentic AI requires each agent to hold a unique identity tied to its supervisor. A capability attaches to that identity, and the two requirements work together. We cover the identity half in your AI agent needs its own identity.
A permission model holds at machine speed when four rules apply at the same time.
Rule two does the quiet work. Where an agent can hand a task to another agent, and grants can widen, your narrow first grant means nothing three hops later.
In one place per domain boundary. The alternative is a check at every point of access, and that alternative fails in a specific way.
A large system accumulates checks. Each one made sense when a developer added it, and the set as a whole then holds no author. Nobody can state your policy, because the policy is spread across hundreds of places, and a change to one does not change the others.
One production estate we work on replaced 219 scattered checks with a single gate. The count is the evidence, and 219 places holding a policy means no place holds it.
The NIST AI Risk Management Framework treats this as a governance function, and the ICO's UK GDPR guidance requires access to personal data to be limited to what a purpose needs.
We build your system on engage.re, and the four rules are properties of the platform.
Sense Future built engage.re, and it has run in production since December 2025.
A council gives an agent the housing officer role so that it can triage repair requests. The role also allows the agent to read tenancy histories and raise payments. Nobody intended that, and the role was the only unit available. A narrow grant for one action on one repair job removes both extra abilities.
A care home group gives an agent access to the care records system so that it can draft shift handovers. The account reaches every resident record in every home. The group runs three systems rather than forty, and the shape of the mistake is the same.
The care home software and security company software pages set out the sector detail. Our guides to lone worker records and the Data Security and Protection Toolkit cover the access obligations that apply either way.
Exactly the permissions its current task needs. Each grant should name one action on one defined scope, and it should be revocable at once. An agent that holds a role holds every ability that role carries, including the ones its task does not need.
Because a role is a permission plus an assumption. The assumption is a person who applies judgement about what falls outside the job. A housing officer knows not to read a neighbour's record, and nothing in the permission model prevents it. Give the role to software, and you keep the permission and lose the assumption.
A grant that states one action on one scope, held by a named identity. It lasts for the task rather than indefinitely, it can narrow and never widen, a cancellation takes effect on the next call, and every use writes an event.
It should be able to pass on what it holds, or less, and never more. Where delegation can widen a grant, a narrow first grant means nothing three hops later. That single rule decides whether privilege can grow through a chain of agents.
In one place per domain boundary. A large system accumulates checks, each one sensible when it was added, and the set then holds no author. One estate we work on replaced 219 scattered checks with a single gate. Where 219 places hold a policy, no place holds it.
We build your system on engage.re. Every grant names one action on one scope, a grant can never widen through delegation, a cancellation takes effect on the next call, one gate decides every domain crossing, and every use joins a signed event chain.
Connect with us about agent permissions · · Replies within 24 hours