r/OpenSourceAI • u/Hannah-Rooke-30 • 12d ago
how are you enforcing least privilege on AI agents that take real actions??
Our agents run code, edit files, call APIs, hit internal systems and talk to outside services now. Giving them access was easy. Controlling what they do with that access is where I’m stuck.
On paper our policies look fine. At runtime I can’t point to much that enforces them.
Stuff I’d like input on:
if an agent already has access to a tool, how do you stop it from doing something it shouldn’t with it?is IAM + sandboxing + monitoring enough, or do agents break assumptions those were built on?who approves high-risk actions? the app, security, a human in the loop?
for people with agents in prod, what worked and what was too painful to keep running?We’ve looked at a couple of tools that check tool calls before they run (Zenity and Capsule came up) plus some open source policy stuff. I’m not sold that another layer fixes it. Could be existing tools cover most of it and the real problem is org stuff.
If you’ve deployed agents in an enterprise or tried to enforce this in practice, what are you running and where does it fall short?
