TalentDeltaHow to narrow an agent: from loose permissions to a fixed one
An agent that writes its own skills is how the work gets found, and it is not the thing you leave running on a Tuesday. Narrowing is a sequence of small trades: each step takes a judgement away from the model and hands it to something you can read, review or switch off. Seven steps, in the order they pay off, with the source behind each one.
What does it cost to leave the permissions wide?
The cost is authority rather than intelligence: what the agent can reach, and how many ways it can be talked into reaching it.
- OWASP names three causes of excessive agency — excessive functionality, excessive permissions and excessive autonomy — and its 2026 list for agentic applications runs to ten classes, among them goal hijack, identity and privilege abuse, memory poisoning, cascading failures and rogue agents (LLM06, the list).
- The counter-rule it proposes is least agency: avoid unnecessary autonomy, because agentic behaviour where it is not needed widens the attack surface without adding value (the PDF).
- Microsoft's security team puts the failure mode in one sentence: a system can be working as designed while taking steps a person would be unlikely to approve, because the boundaries were unclear, the permissions were too broad or tool use was not tightly governed (Microsoft).
- The Knight Institute adds the human failure: autonomy raises the number of possible attack surfaces with it, and disengagement lowers the care with which people approve actions, which produces unintended approvals (levels of autonomy).
- Vendors document their own defaults. Cursor calls its injection guardrails best effort, OpenClaw ships sandboxing off, Claude Code's Bash sandbox is off until it is switched on, and Bedrock's security page warns that anything running inside the microVM can reach the execution role's credentials through the metadata endpoint (Cursor, OpenClaw, Claude Code, AgentCore).
None of this is hypothetical. In July 2025 a Replit agent deleted a live production database, then told its user it had ignored the code freeze and the instruction to ask permission first, and the company's chief executive confirmed what had happened (The Register). That is the lesson worth carrying: an instruction in a prompt is not a permission boundary. A boundary is enforced by the system, or it is not a boundary.
How does a loose agent become a fixed one?
Write down what the agent worked out, then take back the freedom it no longer needs. Each step below replaces a judgement with an artefact, and the agent keeps running while you do it.
| Step | The artefact that replaces the judgement | Where it is documented |
|---|---|---|
| Write the procedure down | the skill file the agent drafted becomes a reviewed document with a name, a description and steps | Agent Skills |
| Enumerate the inputs | the reply is pinned to a schema, so the only freedom left is the value you supplied | Structured outputs |
| Cut the tool list | allow rules for the tools the procedure uses, and a deny rule the model cannot talk its way past | Claude Code permissions, hooks |
| Give the agent its own identity | one identity per agent, with least-privilege roles and its own audit trail | Entra Agent ID, Vertex AI |
| Make the path deterministic where you know it | a workflow your code controls, with the model called as a step inside it | Microsoft, Google Cloud |
| Keep the person where the risk is | a confirmation prompt before the action, and a stop that works | MCP tools, Article 14 |
| Keep the record and the gate | logs over the system's life, and a threshold each release has to pass | Article 12, evaluations |
Run that list and you have the same procedure with the freedoms removed: one identity, one session, a tool list short enough to read, and a decision that repeats. That is the enterprise version of the agent you built while the permissions were wide — not a different product, the same procedure with the loose ends tied.
Two habits make the handover cheaper. Treat the wide-permission run as an instrument, because the skills and notes it leaves are the specification for the fixed version (the parts of an agent). And keep one loose agent after the first is pinned, because the loose end is where the next case is found (the types of AI agent). Teams that build only the fixed end pay for every case nobody foresaw; teams that keep only the loose end cannot show anyone why a decision came out the way it did.
Where to go next
Every agent sits between one that can rewrite its own instructions and one that only varies the value you feed it. What each end is good for.
API keys and permissions for an agentGive it the smallest key that does the job, keep it out of the repository, and know how to revoke it.
What to let your agent touchThe reach inventory, read before write, and a stop you can find in a hurry.
From prototype to production: running an agent for a teamIdentity, secrets, records, approvals and cost: five things that change when others depend on it.