Should AI agents receive permissions dynamically instead of having fixed access?

I would choose D: a stable identity, a small permission baseline and authority limited to the task. The model should not be able to expand its own permissions. For higher-impact operations, approval should cover the exact action, target, parameters and resource version, with expiry and revocation checked before execution.

In my PALO pilot with Copilot Studio and Azure, I separated Microsoft Entra identity and delegated scopes from a time-bound mandate for the specific catalogue operation. I observed a real agent read, a denied proposal and recovery of an expired review request without changing the target. Approved execution and replay remain the next qualification step. I have documented that work here: https://techcommunity.microsoft.com/discussions/copilot-studio/mcp-action-approvals-after-expiry-review-and-replay-tests-from-a-copilot-studio-/4567917

For your design, the target API must still enforce authorization. Delegated and application-only access also need different treatment; an approval in chat does not replace either permission model. Which services will the agent call, and under which identity? Microsoft’s identity reference: https://learn.microsoft.com/en-us/azure/foundry/agents/concepts/agent-identity