How to Constrain AI Agent Identities, Tools and Actions
Summary
The article outlines controls for limiting AI agents’ enterprise authority, including distinct identities, scoped credentials, constrained tools, deterministic authorization, trusted human approval and staged outputs.
Key points
- Give each agent a distinct, auditable identity and restrict credentials by time, resources and permitted operations.
- Keep long-lived secrets outside agent runtimes; use credential brokers and short-lived, task-scoped credentials where possible.
- Replace broad interfaces such as shells or unrestricted SQL with narrow tools, validated parameters and separate read and write operations.
- Govern MCP servers as privileged integrations: review and track their owners, code, tool definitions, access and changes; validate tokens for the receiving service.
- Enforce authorization outside the model and check each request against the identity, user, task, resource and exact parameters.
- Require trusted, explicit human approval for high-impact actions; default to rejection when approval is absent, and bound delegated authority.
- Stage agent outputs for review and validation before they change production systems; restrict agents from modifying their own security controls.
Article Details
- Defense Focus
- Constrain agent authority through distinct identities, scoped credentials, approved tools, deterministic authorization, and controlled approval and staging workflows.
- Detection Methods
- Detect changes to MCP tool names, descriptions, schemas, and instructions.
- Monitor changes to approved MCP server capabilities.
- Evaluate each tool request against the authenticated identity, initiating user, task, resource, parameters, and current risk conditions.
- Rule Types
- Open Policy Agent (OPA) policies
- Cedar authorization policies
- Platforms
- Jamf Pro
- AWS Security Token Service
- HashiCorp Vault
- Open Policy Agent (OPA)
- Amazon Verified Permissions
- GitHub Agentic Workflows
- Defensive Actions
- Give each agent a distinct, auditable identity; use the initiating user's context when appropriate.
- Keep long-lived credentials outside agent runtimes and broker access to short-lived, resource- and operation-scoped credentials.
- Replace broad shell, SQL, and HTTP interfaces with narrow parameterized tools; validate inputs and separate read from write operations.
- Maintain an approved MCP server registry, assign owners, review implementations and tool definitions, and restrict which agents may connect.
- Enforce authorization outside the model for every request, including resource- and parameter-level checks.
- Require trusted out-of-band human approval for high-impact actions, with rejection as the default when approval is absent.
- Constrain delegated authority by resource, operation, duration, action count, or spending limit, and enforce those bounds in policy, credentials, and tools.
- Stage agent outputs as drafts, branches, pull requests, or plans; validate and review them before they become changes.
- Prevent agents from modifying their own approval, policy, logging, credential, MCP, and network controls.
- Apply rate limits, execution budgets, circuit breakers, and an administrative kill switch to production agents.
Vendors
AmazonA Cedar-based service such as Amazon Verified Permissions can similarly evaluate authorization policies and return an allow or deny decision. The application or gateway must still enforce that decision.Amazon Web ServicesFor agent-to-service access, mechanisms such as AWS Security Token Service and HashiCorp Vault dynamic secrets address a complementary requirement: issuing temporary, appropriately scoped credentials rather thanGitHubGitHub describes related principles in the security architecture for GitHub Agentic Workflows. Agents are treated as untrusted, execution is isolated, service access is mediated, and output is constrained rather thanHashiCorpFor agent-to-service access, mechanisms such as AWS Security Token Service and HashiCorp Vault dynamic secrets address a complementary requirement: issuing temporary, appropriately scoped credentials rather thanJamfFor managed Mac devices, Jamf Pro's Local Administrator Password Solution (LAPS) reduces reliance on shared or static administrator passwords by generating unique credentials per device and supporting controlled
Products
Amazon Verified PermissionsA Cedar-based service such as Amazon Verified Permissions can similarly evaluate authorization policies and return an allow or deny decision. The application or gateway must still enforce that decision.AWS Security Token ServiceFor agent-to-service access, mechanisms such as AWS Security Token Service and HashiCorp Vault dynamic secrets address a complementary requirement: issuing temporary, appropriately scoped credentials rather thanGitHub Agentic WorkflowsGitHub describes related principles in the security architecture for GitHub Agentic Workflows. Agents are treated as untrusted, execution is isolated, service access is mediated, and output is constrained rather thanHashiCorp VaultFor agent-to-service access, mechanisms such as AWS Security Token Service and HashiCorp Vault dynamic secrets address a complementary requirement: issuing temporary, appropriately scoped credentials rather thanJamf ProFor managed Mac devices, Jamf Pro's Local Administrator Password Solution (LAPS) reduces reliance on shared or static administrator passwords by generating unique credentials per device and supporting controlledOpen Policy Agent (OPA)Policy systems such as Open Policy Agent (OPA) can separate policy decisions from application logic.