Agent Permissions: Access Control for AI Agents

IRC-Mania Die Seite rund um Sicherheit und Programmierung

Internet, Sicherheit , Internet Relay Chat

Gesponsert

What this article covers

• How permissions work for AI agents.
• Implementing least privilege for agents.
• Controlling tool, system, and data permissions.
• Practical examples for different agent roles.
• Security and compliance best practices.

Introduction: understanding agent permissions

Agent permissions define what an AI agent can do: which tools it can access, which systems it can interact with, which data it can read or modify, and which actions it can perform. Not “everything for everyone”, but rather “only what’s necessary for the task”. This is least privilege applied to agents.

This article is for anyone configuring permissions for agents. For foundational concepts, see Tool Permissions and MCP Permissions.

Why you need agent permissions

Imagine your agent has access to every system. It could delete files, exfiltrate data, manipulate systems. With proper permissions in place, the agent can only read what it needs, write where it’s allowed, and execute only approved operations.

Agent permissions at a glance

Permissions answer: what can the agent do? This covers tools (read/write/execute), systems (filesystem, databases, APIs), and data (which tables, which paths). The principle is simple: least privilege means only necessary permissions.

The core idea is to control what the agent can do.

Who should read this

• Security-conscious teams looking to harden agent deployments.
• System administrators implementing access control.
• Developers building secure agents.
• Compliance officers enforcing organizational policies.

Key concepts

• Least Privilege - Minimal permissions. Use this for security.
• Tool Permissions - Tool access. Use this for managing which tools agents can invoke.
• MCP Permissions - MCP access. Use this for MCP tool control.
• Prompt Injection - Attack vectors. Use this to understand risks.
• Audit Logging - Logging and tracking. Use this for compliance.

Permission model for agents

# Permissions for different agent roles
agent_permissions = {
    "research_agent": {
        "description": "Read-only research, no modifications",
        "permissions": {
            "filesystem": {"read": True, "write": False, "delete": False},
            "database": {"read": True, "insert": False, "update": False, "delete": False},
            "web_search": {"search": True},
            "api": {"get": True, "post": False}
        }
    },
    "writer_agent": {
        "description": "Can read and write",
        "permissions": {
            "filesystem": {"read": True, "write": True, "delete": False},
            "database": {"read": True, "insert": True, "update": False, "delete": False},
            "api": {"get": True, "post": True}
        }
    },
    "admin_agent": {
        "description": "Full control (with approval gates for critical actions)",
        "permissions": {
            "filesystem": {"read": True, "write": True, "delete": True},
            "database": {"read": True, "insert": True, "update": True, "delete": True},
            "api": {"get": True, "post": True, "put": True, "delete": True},
            "system": {"execute": True}
        },
        "requires_approval": ["delete", "system.execute"]
    }
}

Practical example 1: Tool permissions

class AgentPermissions:
    """Manage agent permissions"""

    def __init__(self, role):
        self.role = role
        self.permissions = self.load_permissions(role)

    def can_use_tool(self, tool_name, action):
        """Check if agent can use a tool"""
        if tool_name not in self.permissions:
            return False

        if action not in self.permissions[tool_name]:
            return False

        return self.permissions[tool_name][action]

    def check_tool_permission(self, tool_name, action, context=None):
        """Verify permission with optional context"""
        # Base permission check
        if not self.can_use_tool(tool_name, action):
            raise PermissionError(f"Agent '{self.role}' cannot use '{tool_name}.{action}'")

        # Context-based restrictions
        if context:
            # Path restrictions for filesystem
            if tool_name == "filesystem" and "path" in context:
                if not self.is_path_allowed(context["path"]):
                    raise PermissionError(f"Path '{context['path']}' not allowed")

            # Table restrictions for database
            if tool_name == "database" and "table" in context:
                if not self.is_table_allowed(context["table"]):
                    raise PermissionError(f"Table '{context['table']}' not allowed")

        return True

Practical example 2: Path restrictions

def is_path_allowed(self, path):
    """Verify if a path is accessible"""
    allowed_paths = self.permissions.get("allowed_paths", [])
    denied_paths = self.permissions.get("denied_paths", [])

    # Check denylists first
    for denied in denied_paths:
        if path.startswith(denied):
            return False

    # Check allowlists
    for allowed in allowed_paths:
        if path.startswith(allowed):
            return True

    return False  # Default deny

Practical example 3: Critical actions with approval

def execute_with_approval(self, action, params):
    """Execute critical actions with human approval"""
    if action in self.permissions.get("requires_approval", []):
        # Request approval
        approval = self.request_approval(action, params)

        if not approval["approved"]:
            raise PermissionError(f"Action '{action}' requires approval")

        # Audit log
        self.log_approval(action, params, approval)

    # Execute action
    return self.execute(action, params)

Security guidelines

• Least Privilege: Grant only necessary permissions. See Tool Permissions.
• Path Restrictions: For filesystem access, limit to allowed directories.
• Table Restrictions: For database access, limit to allowed tables.
• Human Approval: Require approval for critical operations like deletions and system execution.
• Audit: Log all permission violations. See Audit Logging.
• Prompt Injection: Agents may attempt to bypass restrictions. See Prompt Injection.

Common pitfalls

• Excessive permissions: Agents receive more access than needed.
• Missing path restrictions: Agents can access any directory on the filesystem.
• No approval gates: Destructive actions like deletions or system commands run without review.
• Unenforced checks: Permissions are defined but not actually validated before each action.
• No audit trail: Permission violations go unrecorded and undetected.

Further reading

• Tool Permissions - Tool access control.
• MCP Permissions - MCP tool permissions.
• Agent Security - Overview.
• Prompt Injection - Attack vectors.
• Audit Logging - Logging and compliance.
• Human Approval - Approval workflows.

Key Takeaways:

• Agent permissions enforce least privilege for tools, systems, and data.
• Different roles serve different purposes: research agents are read-only, writer agents can read and write, admin agents have full control with approval gates.
• Use path restrictions for filesystem access and table restrictions for database access.
• Critical operations require human approval.
• Maintain an audit log of all permission violations.

FAQ

References and further reading

• Least Privilege - Security principle.
• RBAC - Role-Based Access Control.

Premium VPS Hosting

Schnelle und sichere VPS Server

Gesponsert