Extending Least Privilege with Least Agency for AI Agent Security

Permissions aren’t enough for autonomous agents

Forrester notes that an AI authorized to issue refunds can be correctly scoped under least privilege—limited to specific customer records and payment systems—yet still approve inappropriate refunds if its decision logic is unchecked. The shortfall is “excessive agency”: the ability to decide refund size, trigger conditions, and batch volume without human oversight.

Defining the three pillars of least agency

The blog breaks agency into access, authority, and autonomy. Access mirrors traditional privilege: which data and tools the agent can reach. Authority concerns the scope of decisions the agent may enact using that access. Autonomy measures how independently the agent can act, ranging from fully supervised to self-directed. Forrester defines least agency as “continuous enforcement of the minimum decision-making authority and operational autonomy an AI agent requires to pursue its authorized purpose.”

Integrating agency across security domains

Least agency extends beyond identity and access management. Forrester’s AEGIS framework layers IAM (identity, access, delegation), AI governance (purpose, ownership, accountability, boundaries), and runtime security (monitoring, dynamic controls). Together they enable continuous recalibration of what an agent can access, what it is authorized to do, and how independently it may act.

Our read: The argument that AI agents need a distinct “least agency” constraint is compelling, as it reframes risk from static permissions to dynamic decision power. However, translating the concept into enforceable policies will require tooling that can quantify authority and autonomy in real time, a capability that most enterprises currently lack.