AI agent permission management

The control gap

Permissions are scattered across API keys, OAuth scopes, tool catalogs, policy rules, and one-off approvals. A static inventory cannot show which authority is exercised at runtime.

A permission review needs three sets: what the downstream credential can do, what published policy allows, and what the agent actually attempted or executed. Differences have different remedies. Unused provider scopes may require IAM changes; an overbroad policy rule can be narrowed in Endram; a denied attempt may indicate a broken agent, probing, or a missing legitimate workflow.

Recommendations should cite the calls and rule that produced them. The shipped posture workflow finds observed resources, proposes a narrower rule, requires simulation, and creates a draft only after a reviewer acts. It does not silently publish learned policy. This conservative sequence matters because an observation window may miss quarterly operations, incident access, or new resources introduced after analysis.

What good looks like

Observed agent, tool, and resource use is compared with published policy so owners can find unused or overbroad authority and draft narrower rules.

• Capability inventory
• Observed-versus-allowed analysis
• Explainable recommendations
• Simulation before policy drafting

A production workflow

1. Collect signed decisions and outcomes
2. Group access by agent and resource
3. Identify unused or broad rules
4. Simulate and create a review draft

Evidence to require

• Observed resources per agent
• Policy rules creating reach
• Recommendation evidence count
• Simulation and reviewer state

Buyer checklist

• Can the product enforce a decision before the external tool executes?
• Can policy distinguish the agent, delegated user, tool, resource, and environment?
• Can reviewers see the exact requested action and approve it without broadening future access?
• Does every allow, deny, and approval retain the policy version and reason?