Agentic AI Security: Permissions, Human Approval, and Recovery

The central question is authority

A chatbot returns text. An agent may plan, call tools, retain memory, modify systems, initiate transactions, communicate externally, or delegate work. Model behavior matters, but consequence is determined by the authority wrapped around it.

Bound the autonomy

Human approval is not automatically meaningful. The reviewer needs enough context, time, authority, and a usable alternative to reject or change the action.

• Use task-specific, least-privilege identities
• Restrict tools, resources, action types, values, destinations, and time windows
• Require approval for irreversible, high-value, or externally visible actions
• Separate proposal from execution and define a safe state

Treat context and memory as untrusted

Agents consume email, documents, web content, tickets, chat, retrieval stores, and tool output. Treat external content as data, not authority, and validate actions against independent rules. Review who can write memory, how provenance is shown, and how operators correct it.

Make action chains observable and interruptible

A small planning error becomes material when it crosses a trust boundary, gains privilege, changes a source of truth, triggers another system, or becomes difficult to reverse. Good assessment follows those cascades.

• Log goals, tool calls, identities, approvals, results, and exceptions
• Alert on retries, unusual destinations, privilege changes, and cost anomalies
• Test pause, credential revocation, isolation, recovery, and partial completion