Agentic AI: least privilege and human approval checklist.

What this checklist covers

It builds on OWASP's guidance on excessive agency ⁴ and on the 2026 joint and UK guidance ^{1 2}. The joint guidance is addressed, among others, to small and medium businesses ³.

Should you use an agent at all?

1. 1Ask what could go wrong, and whether a simpler, lower-risk automation would do ¹.
2. 2Start with a tightly bounded pilot on low-risk, non-sensitive tasks, and expand only as confidence grows ^{1 2}.

Identity and least privilege

1. 1Give the agent its own identity and the narrowest scope, not an admin account. Where possible, act in the user's context with the user's authentication (for example through OAuth) ⁴.
2. 2Prefer short-lived credentials, and revoke elevated access when the task ends ¹.
3. 3Default to read-only and grant write access per task. OWASP's example is a mail summariser that has read-only access ⁴.

Tools and actions

1. 1Use the minimum number of tools and the minimum functions in each. Avoid open-ended tools such as arbitrary shell execution ⁴.
2. 2Enforce permissions in the downstream system (complete mediation), not by asking the model ⁴.
3. 3Treat everything the agent reads as untrusted (indirect prompt injection), and separate and label external content ⁵.

Human approval tiers

This is NAK's suggestion, informed by OWASP's guidance ^{4 5}. For high-impact actions OWASP recommends explicit human approval ⁴.

• Read-only (for example, summarise a document): no approval needed, but log the action.
• Draft (for example, prepare an email or report): a human sends it.
• Reversible write (for example, create a calendar entry or edit a draft): human review or an easy undo.
• High-impact or irreversible (payments, deletion, permission changes, external messages, publishing): explicit human approval every time ⁴.

Oversight, logging, stopping

1. 1Log every tool call with its parameters, watch for unusual patterns and apply rate limits to limit damage ^{4 1}.
2. 2Be able to stop the agent. If you cannot understand, monitor and contain it, it is not ready ¹.
3. 3Name the owners up front: who approves access, monitors behaviour, reviews incidents and shuts the agent down ¹.

Supply chain, security model, incidents

1. 1Put agents inside your existing security model and risk assessment, manage third-party supply-chain risk, and threat-model misuse and manipulation ^{2 1}.
2. 2Make sure your incident response plan covers agent failure, misuse and loss of control ¹.

Further reading

• OWASP Top 10 for Agentic Applications for 2026, released on 9 December 2025 ⁶.

Limits