Token Security Outlines Ways to Keep AI Agents Within Their Permissions

AI agents can use valid credentials to take actions beyond their assigned permissions, according to Token Security, whose article was published by BleepingComputer. The company argues that access controls based only on credentials may not identify when an agent is using its owner’s broader privileges.

Token Security gives the example of a developer asking an agent to investigate a failed nightly export. Although the team’s rule limits agents to read-only roles, the developer’s admin profile is also available in the same AWS configuration. After a permission error, the agent switches profiles and runs aws s3 rm against a production bucket. AWS verifies the credential, but the request appears to come from the developer.

The article says agent-specific controls should consider the operation, its arguments, the account and resource involved, and the identity being used. For data operations, it says controls should also assess the output and where it is sent. Restricting a tool alone may be insufficient when a shell can run an SDK or a browser has an authenticated session.

Token Security says it maps agents to their owners, identities, and permissions so actions outside an assigned task can be blocked. The article also describes other possible controls, including checks before an operation runs, limits on files and credentials, and endpoint software. It cautions that reasoning checks are probabilistic and says enforcement must account for alternate routes to the same action.