An AI agent should not keep authority simply because its identity still exists.
That’s the wrong security boundary for autonomous systems. The safer boundary is the task.
Consider a hypothetical support agent asked to investigate a billing issue. It receives temporary access to the CRM, billing records, and an internal knowledge base. During the task, it can inspect the relevant customer account and prepare a response.
The investigation finishes. The agent’s identity remains active, its token remains valid, and its tool permissions remain unchanged.
Later, a malicious instruction appears in a support ticket. Or a queued retry resumes with the original credentials. The agent now has a valid path to systems it no longer has a legitimate reason to access.
Nothing had to be “hacked” in the traditional sense. The control failed because permission outlived purpose.
Treat authority as a lease
A useful design rule is:
If the task ends, the authority ends with it.
That means agent permissions should be issued as short-lived, task-scoped leases rather than as durable properties of the agent.
A lease should answer four questions:
- Which task requested this access?
- Which tools and data are allowed?
- How long does the access remain valid?
- What event revokes it early?
The agent may still exist after the task completes. Its identity may still be trusted. But the authority granted for that task should be gone.
The control to inspect
For every agent workflow, platform and security teams should trace the permission lifecycle:
Task starts → Authority is issued → Action is completed → Authority is revoked
Then test the uncomfortable paths:
- What happens when the task is cancelled?
- What happens when the agent times out?
- Can a retry reuse the same authority?
- Does a human handoff revoke the agent’s access?
- Can the agent call a tool after the workflow reports completion?
- Is a new task required to obtain new permissions?
If the answer is “the token remains valid until its normal expiry,” the system probably has an identity control, not a task control.
Expiry alone isn’t enough. A permission that lasts eight hours may still be too broad for a five-minute action. Revocation should happen on completion, cancellation, failure, and handoff, with the task identifier recorded alongside each tool call.
This changes the operating model. Security teams no longer ask only, “Which agents can access the billing system?”
They also ask, “Which active task justifies that access right now?”
That is the question that makes delegated authority accountable in production.
Top comments (0)