AI and LLM Security
AI Agent Permission and Tool Security
We test the tools your AI agent can access, its permissions and approval steps. You see what a misdirected agent could do before it goes live.
What it is
An AI agent is a model that calls tools itself to complete its task. It can send email, update records or initiate a payment. OWASP defines giving an agent more tools, permissions or autonomy than needed as the Excessive Agency risk. When an agent is misdirected, it is the surrounding permission and approval layers, not the model, that limit the damage.
Scope
- Every tool the agent can access, and the permission each uses
- On whose behalf the agent acts, and with which account
- Whether human approval can be bypassed for irreversible actions
- Whether the approval screen shows the agent's summary or the actual action parameters
- Permissions of MCP servers and third-party plugins
- Whether agent actions are logged and can be stopped if needed
The need
When organizations need it
- Before an agent used by the finance team is allowed to prepare payment instructions.
- When developers want a coding agent to access code repositories and the CI/CD pipeline.
- When an MCP server or an off-the-shelf plugin is about to be connected to your internal systems.
Method
How we work
-
Tool inventory
We identify the tools the agent can access, the permission behind each, and their action limits.
-
Steering scenarios
We attempt to steer the agent outside its task through the content it processes.
-
Approvals and limits
We test whether approval steps and limits such as amount or recipient withstand a steered agent.
-
Narrowing permissions
We recommend the narrowest permission each tool needs and which actions should require approval.
Outcome
What you have at the end
You know the most harmful action your agent could take if misdirected. You have the permission and approval rules to stop that action outside the model.
Frequently asked questions
Is adding human approval enough?
It depends on what the approval screen shows. A summary written by the agent can mislead. The screen should show the real parameters of the action, such as recipient and amount.
Should the agent act with its own account or with the user's rights?
The risks differ. An agent acting with a user's rights can access everything that user can. An agent with its own account needs permissions narrowed to its job.
AI and LLM Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting