Least Agency: Shrinking Agent Authority

At Black Hat in August 2026, the security industry converged on the same core problem from different angles: agents inherit the broad standing permissions built for human employees and become an unmonitored shadow workforce. Rubrik launched Agent Identity, authorizing agents one tool call at a time and eliminating standing permissions; Zero Networks launched Least Agency Enforcement, constraining compromised agents at the network layer. With OWASP writing least agency into its Agentic Applications Top 10, the security paradigm is shifting from least privilege to least agency.

Agents Inherit Human Permissions and Become a Shadow Workforce

Rubrik's Agent Identity targets the credential layer beneath agent deployments. Agents typically inherit the broad, standing permissions built for human employees — as Rubrik's GM of AI Dev Rishi put it, these access models were never designed for autonomous actors. A single compromised or misbehaving agent can act destructively across SaaS applications, databases and APIs before anyone notices.

Rubrik Zero Labs research quantifies the gap: 86% of global IT and security leaders expect AI agents to outpace their organization's security guardrails within the next year, while only 23% have full visibility into the agents already running in their environments. This is adoption outpacing visibility — agents are running, but enterprises cannot see what they hold or what they do.

Per-Tool-Call Authorization: Eliminating Standing Permissions

Agent Identity works like this: first build an inventory of running agents, MCP servers, skills and plugins; then scope access to specific servers and tools by user and group using On-Behalf-Of federation, which extends existing identity structures rather than replacing them. Standing permissions are eliminated, replaced by scoped, short-lived tokens minted for each individual tool call.

Enforcement happens at an MCP gateway. Every tool call clears three checkpoints before executing: behavioral analysis — the SAGE governance engine evaluates the intent, input parameters and likely operational impact of the request; a policy check at the infrastructure layer; and identity verification that authenticates the agent session and issues the token scoped to that call. An unauthorized write or modification outside an explicit policy scope is blocked before execution. For actions that clear the gateway and still go wrong, Agent Rewind reverses them — a capability Rubrik describes as the only one of its kind on the market.

Network-Layer Least Agency: No Lateral Movement After Compromise

Zero Networks takes a complementary route, focusing on where an agent can go after it already holds valid credentials. Its Least Agency Enforcement builds on an identity-based micro-segmentation platform, restricting agents at the host firewall to explicitly authorized systems and resources — denying everything outside that set by default, so agents cannot exceed their intended autonomy.

Sensitive protocols (RDP, SMB, WinRM) are routed through just-in-time MFA: even if an agent identity is compromised, it cannot quietly use those protocols to move sideways. Zero Networks' research found roughly 80% of enterprises have already deployed internal AI agents, yet about two-thirds still lack governance policies for them — the gap network-layer enforcement is meant to fill.

From Least Privilege to Least Agency

The least agency principle in OWASP's Agentic Applications Top 10 advances the question from who may access which resources to what decisions and actions an agent may take. Least privilege limits resource access; least agency limits decision and action. Together they form a complete constraint on autonomous actors: agents can neither touch what they should not nor do what they should not.

Zero Networks' positioning also clarifies the boundary: conventional IAM, PAM and non-human-identity (NHI) platforms primarily govern whether an AI is entitled to receive access; once an authenticated session begins, they generally do not control where the agent can move across the network. That is the gap network-layer least agency fills — the identity layer decides whether to let it in, the network layer decides where it can go and what it can do once inside.

The OOMeta View

Least agency marks agent security moving from identity admission to behavior constraint: deciding not only whether an agent gets access but what it can do and reach in each action. The adoption path for enterprises is concrete and actionable — build an agent inventory, replace standing permissions with per-call authorization, deny by default at network and identity layers, and add MFA to sensitive paths. When agents begin acting on behalf of employees across SaaS, databases and APIs, enterprises must give these machine workers the same — or stricter — least-privilege baseline they give their human staff.

References: SiliconANGLE, "Rubrik unveils Agent Identity to govern AI agents one tool call at a time", 2026-08-04, https://siliconangle.com/2026/08/04/rubrik-unveils-agent-identity-govern-ai-agents-one-tool-call-time/ · CSO Online, "Zero Networks targets AI agent security gaps with network-level 'Least Agency' controls", 2026-08-03, https://www.csoonline.com/article/4204394/zero-networks-targets-ai-agent-security-gaps-with-network-level-least-agency-controls.html