Before you connect a vendor's AI agent, get a written list of the identity it uses, the scopes it holds, how long its credentials last, and every action it can take. Require least privilege, expiring credentials, and logs you can read yourself. If the vendor cannot list these, do not connect it to production.
Why this deserves its own review
An AI feature that only reads is one risk. An agent that reads, decides, and acts is another. It may open pull requests, change settings, or call other tools. The OWASP Top 10 for LLM Applications 2025 names excessive agency, where a system has more functionality, permissions, or autonomy than it needs, as one of its ten risks. The access list is how you check for it.
The access inventory to request
| Item | What to get |
|---|---|
| Identity | A distinct account or service identity, not a shared admin |
| Scopes | Repositories, projects, and actions allowed |
| Credentials | Type, lifetime, rotation, where stored |
| Actions | Read, comment, open PR, merge, change settings |
| Logs | Every action with time, target, and trigger |
| Revocation | How you cut access instantly |
Principles to ask for
- Distinct identity. The agent should have its own identity so its actions are attributable.
- Least privilege. Start with read only and add specific permissions with a reason.
- Short lived credentials. Long lived tokens in an agent are a larger target.
- Approval for risky actions. Merges and permission changes should need a person.
- Visible logs. You should not depend on the vendor to tell you what the agent did.
Test it
Connect the agent to a sandbox first. Try to make it act outside scope, and confirm it fails. Revoke its access and confirm that it can no longer act. Check that the log shows each step, including the failed ones.
Review on a schedule
Access drifts. A permission added for a pilot can linger after the pilot ends. Put a quarterly review on the calendar to confirm each scope is still needed. Remove what is not.
Plan for the bad day
Know in advance who can revoke access and how, and write the steps down. If a vendor reports an incident in their AI feature, you want to cut access within minutes, not hunt for who holds the admin console.
Try it yourself
Click through it at your own pace, or open it full screen.
See which tools and permissions are granted in the setup, and compare them with the access inventory above.
Where Safeguard fits
Safeguard provides agent identity and an MCP Guardrail, so AI agent access can be scoped and recorded.
Quick check
Should an agent share a human's credentials?
No. Give it its own identity so actions can be attributed and revoked.
How often should access be reviewed?
At least quarterly, and whenever the agent's job changes.
Sources
- OWASP Top 10 for LLM Applications 2025: https://genai.owasp.org/llm-top-10/
Last reviewed: 19 October 2026.
