Forrester proposes least agency for AI agents

The author argues that the traditional cybersecurity principle of least privilege is insufficient for AI agents because they can possess correct permissions yet still execute unauthorized or excessive actions. To address this risk, organizations must govern access, authority, and autonomy together through a concept called least agency. This approach continuously enforces the minimum decision-making authority and operational autonomy an AI agent requires to fulfill its purpose. Open article →