Should AI agents receive permissions dynamically instead of having fixed access?

Hi everyone,

As AI agents move from simple chat-based assistants toward performing real actions—such as querying databases, creating resources, modifying configurations, sending notifications, or executing workflows—I have been thinking about how their permissions should be designed.

A traditional application typically has a relatively well-defined permission model. An AI agent, however, may perform different tasks depending on the conversation and the user's request.

For example:

• Task A may only require read access.

• Task B may require creating a resource.

• Task C may require modifying an existing configuration.

• Task D may involve a potentially destructive operation.

This raises an interesting security question:

Should an AI agent have a fixed set of permissions for its entire lifetime, or should permissions be granted progressively based on the task it is currently performing?

For example:

User → AI Agent → Read-only permissions

Then, if the user explicitly requests a change:

User approval → Temporary elevated permission → AI Agent performs the operation → Permission revoked

I see some potential advantages to this approach:

1. Reduced blast radius if the agent behaves unexpectedly.

2. Better alignment between permissions and the actual task.

3. Easier auditing of elevated operations.

4. Reduced risk from prompt injection or unintended actions.

5. Human approval could be required only for high-impact operations.

However, it also introduces additional complexity around identity, token issuance, approval workflows, session management, and auditing.

I'm curious how others are approaching this.

Would you prefer:

A. Fixed least-privilege permissions for each agent

B. Dynamic/task-based permissions

C. Fixed permissions with human approval for sensitive operations

D. A combination depending on the workload

For production AI agents, which model do you think provides the best balance between security and usability?

Would be particularly interested in experiences from people implementing agents in enterprise environments.