Zero Trust for AI Agents: The Architecture for Agent-Run Work
Zero Trust for AI agents means every agent action is tied to identity, least agency, human approval, traceability, and signed evidence before it reaches business systems.
Agent security architecture
What Is Least Agency?
Least Agency is the agentic AI security principle that gives an AI agent the minimum tools, permissions, autonomy, memory, and delegation needed for its task.
Updated Jun 7, 2026
Least Agency is least privilege adapted to AI agents. It means minimum tools, minimum permissions, minimum autonomy, minimum memory access, and minimum delegation for the current workflow, with human approval when the agent reaches a high-impact action.
Key takeaways
- Least Agency responds to the same root problem OWASP calls Excessive Agency: excessive functionality, excessive permissions, and excessive autonomy.
- An agent can be overpowered even when every individual permission looks reasonable.
- Least Agency scopes the agent by workflow, action type, data, tool, risk level, time, and approval requirement.
- The goal is not to make agents useless. It is to give them enough agency to work and not enough agency to create avoidable incidents.
Definition: Least Agency
Least Agency is the principle that an AI agent should have only the agency required for its current workflow. Agency includes tools, permissions, autonomy, memory, delegation, and the ability to continue without human review.
This is different from ordinary least privilege because agents do not only hold access. They choose actions, combine tools, use context, and continue over multiple steps. Least Agency limits the action space, not only the account permissions.
minimum tools, minimum permissions, minimum autonomy
The practical version is simple: minimum tools, minimum permissions, minimum autonomy. A support agent that drafts replies does not need delete access. A research agent does not need send access. A coding agent may need read access broadly, but destructive shell commands and production writes should be gated.
| Agency dimension | Bad default | Least Agency default |
|---|---|---|
| Tools | Give the agent every connector in the workspace. | Expose only tools required for the workflow. |
| Permissions | Use a broad service account. | Use scoped credentials and separate read from write. |
| Autonomy | Let the agent execute every tool call. | Pause high-impact actions for human approval. |
| Memory | Let the agent reuse broad persistent memory. | Limit memory to relevant workflow context. |
| Delegation | Let agents call other agents freely. | Restrict delegation paths and preserve ownership. |
How Least Agency maps to OWASP Excessive Agency
OWASP describes Excessive Agency as a vulnerability caused by excessive functionality, excessive permissions, and excessive autonomy. Least Agency is the positive architecture pattern that addresses those root causes.
The principle is especially important for agentic systems because prompt injection, hallucination, tool misuse, or peer-agent compromise can all become worse when the agent has more reach than the workflow requires.
| OWASP risk pattern | Least Agency control |
|---|---|
| Excessive functionality | Remove tools and functions the workflow does not need. |
| Excessive permissions | Scope downstream access and avoid generic high-privilege identities. |
| Excessive autonomy | Require approval for high-impact actions and define timeout behavior. |
| Tool misuse | Validate tool arguments and gate risky tool calls at runtime. |
| Identity and privilege abuse | Bind action authority to verified agent identity and owner. |
Least Agency in Contro1
Contro1 helps implement Least Agency by making agent authority visible, manageable, and tied to the organization. Teams can see the agents in the organization, inspect what each one is allowed to do, review its recent actions, and apply approval gates that route to the right role, department, manager, policy owner, fallback owner, or escalation chain when actions send, delete, publish, spend, export, update, or deploy.
That keeps the agent useful while preventing the most common failure mode: letting a capable agent cross a business boundary without the right organizational decision or a record of what happened.
Zero Trust for AI Agents · Agent Identity · When should AI agents require approval?
Frequently asked questions
What is Least Agency?
Least Agency is the security principle that an AI agent should have the minimum tools, permissions, autonomy, memory, and delegation needed for its current workflow.
How is Least Agency different from least privilege?
Least privilege focuses on access permissions. Least Agency also controls autonomy, tool choice, memory, delegation, and action execution.
Why do AI agents need Least Agency?
Agents can combine allowed tools into risky action chains. Least Agency limits the action space before a prompt injection, mistake, or bad goal creates damage.
Does Least Agency mean agents cannot work autonomously?
No. It means safe low-risk work can run autonomously while high-impact actions require policy checks or human approval.
How does Contro1 support Least Agency?
Contro1 supports Least Agency by showing each agent and its action scope, pausing risky actions, routing approval through organizational roles and hierarchy, enforcing escalation, and recording what the agent did before the workflow resumes.
Related resources
What Is Agent Identity?
Agent identity gives every AI agent a unique, owned, verifiable identity so its actions can be scoped, governed, traced, and audited.
Agent Inventory: How to Find, Own, and Govern Every AI Agent
An agent inventory helps security and operations teams see which AI agents exist, what they can access, what actions they can take, and who owns them.
Agent Traceability: How to Track AI Agent Decisions
Agent traceability lets teams reconstruct agent decisions across prompts, tools, policies, approvals, callbacks, and outcomes.
12 guardrails every AI agent needs before production
A practical checklist of the runtime controls, permissions, validations, and approval layers production AI agents need before they ship.
How to choose the owner of an AI agent
A short practical guide for assigning an AI agent owner: who should be accountable, when a VP or department head should own it, and how to record fallback ownership.
System of Record for AI Agents: Why Every Enterprise Needs One
Your ERP is the system of record for money and your CRM for customers. AI agents now take real business actions with no system of record at all. Here is what one must capture and how to stand it up fast.