Least agency and observability are the core of governable AI agents

At a glance

What this is: This is an analysis of why governable AI agents need least agency and strong observability, with the core finding that least privilege by itself does not control autonomous action chains.

Why it matters: It matters because IAM and security teams must govern runtime authority, delegated actions and auditable decision paths, not just whether an AI agent can access a resource.

Context

AI agent governance is the problem of controlling what an autonomous system can do, how far it can go, and how clearly its actions can be traced. In this article, WorkOS argues that the key design choices are least agency and strong observability, because those two controls shape whether an agent stays inside auditable boundaries.

The article distinguishes least agency from least privilege. Least privilege limits access to data or tools, while least agency limits the freedom to act on that access without checkpoints, approval gates or task-scoped constraints. That distinction is central to NHI and agentic AI governance because a system can be narrowly permitted yet still behave with excessive runtime autonomy.

WorkOS also frames observability as more than logging. For security and IAM teams, the practical issue is whether every tool call, decision step and authorization chain can be reconstructed after the fact, especially when agents delegate, chain actions or trigger irreversible changes in production systems.

Key questions

Q: What breaks when AI agents are given broad inherited permissions?

A: Broad inherited permissions break the assumption that access is tied to a narrow business need. The result is larger blast radius, weaker accountability, and faster propagation of mistakes or abuse across connected systems. A single compromised or misconfigured agent can then touch far more data and workflows than the original task required.

Q: What is the difference between observability and simple logging for AI agents?

A: Logging records events, but observability connects those events to agent behaviour, task flow, and outcome quality. For autonomous AI systems, that distinction matters because teams need to understand why an action happened, how a workflow progressed, and whether the result met the goal. Observability gives a fuller operational picture for tuning and governance.

Q: How should security teams prevent AI agents from escalating privileges through delegation chains?

A: Security teams should make delegation one-way and scope-reducing at every hop. If an agent passes work to another agent or service, the next identity must inherit equal or lower privilege, never more. That rule should be enforced in token exchange policy, service authorisation, and runtime access checks so that privilege cannot accumulate across chained actions.

Q: How do least agency and strong observability work together in AI governance?

A: Least agency reduces the space of possible actions, which makes observability tractable. Observability then shows whether the remaining actions are normal, unsafe or too broad, giving teams the evidence needed to tighten or relax autonomy. One without the other either hides behaviour or creates a firehose of ungoverned activity.

Technical breakdown

Least agency vs least privilege

Least privilege answers what an identity can access. Least agency answers how much it can do with that access without checking back. For AI agents, that difference matters because runtime behaviour includes planning, sequencing, delegation and action timing, not just permission checks. A system may have read-only access to one database and write access to one email tool, yet still act with excessive agency if it can choose targets, draft content and send messages autonomously. In governable AI design, access scope is only one control surface. The more important question is whether the system can combine permitted actions into an unaudited workflow.

Practical implication: Model agent control as both authorization scope and action freedom, then treat either one as a separate governance decision.

Why observability must include decision, action and identity layers

Strong observability for AI agents is not a single log stream. It is a linked view of the plan the agent formed, the tools it used, and the identity chain that authorized each step. Decision-layer observability captures why an action was chosen. Action-layer observability records what the agent did. Identity-layer observability shows on whose authority it acted and what credentials or delegation path were used. Without all three, teams can see activity but cannot reliably explain it, audit it or detect scope drift. This is the difference between searchable logs and governable runtime behaviour.

Practical implication: Design telemetry so every action can be traced back to the plan step and authorization decision that caused it.

Agency is a matrix, not a slider

WorkOS breaks agency into scope of action, depth of planning, breadth of delegation and reversibility of actions. That is the right model because risk rises when these dimensions combine, not when any one dimension changes in isolation. A shallow, single-step agent with reversible actions can often operate safely with more autonomy than a multi-step agent that can delegate to sub-agents and trigger irreversible operations. This is why broad tool access, deep planning and recursive delegation create governance risk that traditional access reviews do not capture well. The control problem is behavioural, not just entitlements-based.

Practical implication: Review agent permissions alongside planning depth, delegation reach and irreversible action paths before expanding autonomy.

Threat narrative

Attacker objective: Exploit legitimate agent authority to produce unaudited, irreversible actions that outgrow the original user intent.

1. Entry occurs when a legitimate agent session is granted scoped credentials and access to production tools for a task. The system is not necessarily compromised at the start, because the risk begins with authorized runtime access rather than stolen credentials.
2. Escalation happens when the agent chains multiple permitted steps, expands through delegation or selects broader actions than the original human intent anticipated. In that moment, least privilege still looks satisfied even though agency has grown beyond what the governance model can safely observe.
3. Impact follows when the agent executes irreversible actions such as sending messages, changing records or provisioning infrastructure without adequate checkpoints. At that point, observability becomes the only reliable way to reconstruct what happened and whether the action remained within authority.
4. The attacker objective, or failure objective in this pattern, is to let autonomous runtime behaviour cross the boundary from approved task execution into unaudited production impact.

Breaches seen in the wild

• Nx s1ngularity attack 2025: Attackers stole Nx's npm token via a GitHub Actions flaw and shipped malware that stole 2,349 secrets and abused developers' AI CLIs.
• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Least agency is the missing governance layer between access and autonomy: least privilege was designed for identities whose access can be bounded at provisioning time. That assumption fails when an AI agent decides which actions to combine, when to execute them and whether to continue without a human checkpoint. The implication is that governance must move from static permissions to runtime authority boundaries.

Strong observability becomes a control, not a record: logs alone do not make an agent governable because they capture activity without explaining intent or authorization chain. AI agents need linked decision, action and identity evidence so security teams can determine whether a step was legitimate, delegated, or beyond scope. Practitioners should treat observability as a prerequisite for safe autonomy, not a post-incident forensic layer.

Agency should be decomposed before it is expanded: broad tool access, deep planning, delegation chains and irreversible actions each add a different kind of risk. The current habit of treating agent autonomy as a single on-off setting hides where governance actually breaks. Teams should govern these dimensions separately because one safe dimension does not make the whole system safe.

Permission attenuation is the right mental model for agent delegation: every downstream agent should operate with a smaller authority surface than the actor that delegated to it. When sub-agents inherit effective power through natural-language instructions rather than enforced controls, accountability becomes opaque. The practitioner conclusion is simple: delegation must be structurally bounded, not merely documented.

Governable agents require runtime evidence, not trust in design intent: the article points toward a category shift where the question is no longer whether an agent was built responsibly, but whether every production action can be explained after the fact. That is a material change for NHI and AI governance teams. The useful standard is not declared autonomy, but provable restraint.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Least agency is the control boundary that lets observability become useful: when agents can plan, delegate and act across production systems, the main question is no longer whether access exists but whether runtime authority stays bounded enough to audit. If observability does not include decision and identity lineage, it cannot distinguish intended automation from scope drift.

Permission attenuation should be treated as an identity design rule: every downstream agent or sub-agent should inherit less authority than the actor above it. That matters because delegated systems create transitive trust relationships that traditional review processes are poorly equipped to evaluate.

AI systems with least-privileged access had a 17% incident rate vs 76% for over-privileged systems, according to the 2026 Infrastructure Identity Survey.** That gap shows why access scope alone is not enough if the agent can still combine permissions into harmful runtime sequences.

For practitioners

• Define least agency as a control objective Separate agent freedom from access rights in your governance model so security teams review what the agent can do, not only what it can reach.
• Scope credentials to a single task Issue time-bound, task-specific credentials so an agent cannot reuse broad permissions across unrelated workflows or later sessions.
• Instrument decision, action and identity telemetry Capture plan steps, tool calls and authorization lineage in one queryable event model so agent behaviour can be reconstructed end to end.
• Break broad tools into narrow functions Replace open-ended database or workflow tools with specific functions that constrain inputs, outputs and permitted resources.
• Gate irreversible actions with checkpoints Require approval for actions that send, change or delete production state, especially when the agent can chain those actions together.

Key takeaways

• AI agent governance fails when teams treat permissions as the whole control story instead of managing runtime agency as a separate risk.
• The article's core architecture is a feedback loop: constrain what the agent can do, then observe what it actually does, then tighten the boundary again.
• For practitioners, the key shift is from reviewing static entitlements to proving that every agent action remained within a bounded and attributable identity chain.

Key terms

• Least Agency: The agentic equivalent of least privilege, the principle that AI agents should be granted only the minimum level of autonomy necessary to complete their designated task, and no more. Coined in the OWASP Top 10 for Agentic Applications 2026.
• Partial Observability: Partial observability means the system cannot directly see the full state of the environment and must infer it from incomplete or noisy signals. In AI and security, this is what makes hidden hypotheses, uncertainty, and belief updates necessary rather than optional.
• Permission Attenuation: A control principle in which each delegated hop receives equal or lesser authority than the previous one. For autonomous or spawned agents, attenuation must be enforced at runtime, because the risk is not just over-privilege at issuance but privilege growth through chaining.
• Reversible Action: A reversible action is an automated step that can be safely undone or corrected without lasting operational harm. Examples include adding notes, changing severity, or creating a case. In SOC automation, reversible actions are the safest candidates for unattended execution because they preserve the ability to recover from a wrong decision.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.