Topic starter
22/06/2026 10:17 am
TL;DR: AI agents should not inherit a user’s full permission set, because delegated access must be bounded by both the user’s current rights and the agent’s configured scope, according to WorkOS. The intersection rule is the practical control that prevents excessive agency, confused deputy abuse, and avoidable production damage.
Editorial analysis by NHI Mgmt Group, based on content published by WorkOS: “Delegated access for AI agents: The intersection rule explained”.
By the numbers:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
Key questions
Q: What breaks when AI agents are given broad inherited permissions?
A: Broad inherited permissions break the assumption that access is tied to a narrow business need.
Q: Why do AI agents need downscoped tokens instead of forwarded session tokens?
A: Forwarded session tokens let downstream services see the human’s full authority, which defeats delegated access control.
Q: How can security teams prevent confused deputy risk in agentic workflows?
A: Separate the agent’s identity from the user’s identity, constrain the agent’s own configured scope, and require every tool call to carry a token that reflects the overlap of both.
Practitioner guidance
- Define a separate agent principal Register each agent with its own client ID and provision a role that reflects the smallest task scope it must perform.
- Downscope every tool call with token exchange Use RFC 8693 token exchange so downstream services receive a token that reflects both the user and the agent, plus a resource-specific audience.
- Recompute access at each invocation Evaluate the user’s current permissions at the moment of the tool call, not at session start.
Bottom line: AI agent access becomes risky when the user’s full permissions are treated as the agent’s permissions, because that turns routine delegation into excessive agency.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 11:07 am
The intersection rule is a governance control, not an implementation preference: it is the point at which agent access stops being a proxy for human access and becomes an independently governed identity decision. The article is right to separate user rights from agent rights because the security question changes once software can reason over tasks at runtime. Practitioners should treat that split as a baseline assumption for agent authorisation design.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when user permissions change during an active agent task?
A: Treat permission checks as real-time, not session-scoped. If a user is demoted, revoked, or offboarded while an agent is still working, the next token exchange must reflect the new state immediately. Cached authorisation creates stale access and defeats the purpose of delegated control.
👉 Read our full editorial: Delegated access for AI agents: why the intersection rule matters