{
  "id": 9500225,
  "title": "Your AI agent has more permissions than your users",
  "url": "https://urgent.news/2026/09/24/your-ai-agent-has-more-permissions-than-your-users",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-24T05:54:34.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/roee_hershko_bc6f44186f8e/your-ai-agent-has-more-permissions-than-your-users-50in"
  },
  "original_language": "en",
  "account": "A growing number of companies are facing a problem with AI agents and chatbots that have more permissions than their human users. For example, Dana may not be authorized to delete branches in a repository, but an AI agent acting on her behalf can do so. This is because most AI agents and chatbots connect to different systems like Jira, GitHub, Slack, Salesforce, and AWS through a service account with extensive access.\n\nThe issue is not new, but AI agents make it more problematic. These agents take free-form requests, chain tool calls on their own, and can be influenced by their prompts. To address this, teams often try to limit the agent's actions with prompts like \"Only perform actions the user is authorized for.\" However, this approach is ineffective because the model does not know the user's permissions, and the tool call runs with the bot's credentials regardless of the model's belief.\n\nA more reliable solution is to enforce authorization outside the model, in code, before the tool runs. One approach is to use per-user OAuth, where the agent acts with the user's token, and the system enforces the user's permissions. However, this method may not be available or practical in many systems, and it requires users to go through a consent screen for each system.\n\nAnother approach is to use a policy engine like OPA, Cedar, or a config file to check permissions. While this works on day one, it becomes challenging to keep the policy in sync with changes in roles, repository teams, Jira permission schemes, and IAM policies. A more efficient solution is to ask the system that already knows the user's permissions before performing the action. This is what the author built using hallpass, a small, self-hosted service that checks permissions live with read-only credentials and returns a decision of allow, deny, or unknown. By using hallpass, the agent keeps its own credential and only performs the action if the check allows it, providing a more trustworthy solution than relying on prompts or policy engines.",
  "summary": "Here is a conversation that happens in a lot of companies right now: Dana: @assistant please close PAY-123 and delete the old release branch Assistant: Done ✅ The problem: Dana is not allowed to delete branches in that repository. The assistant is. Most AI agents and chat bots act in other systems (Jira, GitHub, Slack, Salesforce, AWS) through one service account . That account needs enough…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}