Your AI Agent Is a New Identity. Give It Least Privilege

A prompt can describe what an agent should do. Only an authorization system can enforce what it is allowed to do.

A banking AI agent may search internal documents, open a service ticket, prepare a payment instruction, or update a customer record. Each capability gives the agent a path into systems that already have their own users, permissions, and audit requirements.

That makes the agent more than a model connected to tools. It is a new actor in the institution’s identity and access design.

Do not let the prompt become the permission boundary

A system prompt can say “never transfer money” or “only use approved documents.” It is useful guidance for model behavior. It is not a security control.

Authorization needs to be enforced outside the model, at the point where a request reaches a protected resource or action. If the model proposes an action, the application should still verify that the action is allowed for this agent, this user, this case, and this moment.

A practical design separates three things:

• The agent’s service identity: What can this running software access at all?