An AI agent is a service account that can be talked into things.
That is the whole threat model, and it is worth saying plainly because the industry is currently discussing this as though it were a new category of problem requiring new categories of product. It mostly is not. Everything you already know about service accounts applies. There is one addition, which is that this service account takes instructions from text it did not write, and some of that text arrives from outside your organisation.
Why it got admin
Not carelessness. Scope is set under time pressure by somebody who does not yet know what the thing will need, and the fastest way to guarantee the demo works is to grant everything and narrow later. Narrowing later is a task with no deadline attached to it, so it competes with tasks that do, and loses.
This is the ordinary way that scope gets set for anything. It is worth naming because the fix is organisational, not technical.
Three questions
If you cannot answer these, you do not have a scope, you have a hope.
- What can it reach?
- When did it last use that access?
- How do I revoke it in a single action?
Every one of these is answerable in an afternoon, and almost nobody has done the afternoon. Not because it is hard. Because no single person has been made responsible for it, and it sits between the team that built the agent and the team that runs identity.
The scope test
Write down the one job the agent exists to do. One sentence.
Everything the agent can do beyond that sentence is blast radius. Not risk in the abstract, and not a number on a heat map. The literal list of what happens if the thing is convinced to do something other than its job.
Give it its own identity
Not a shared service account. Its own user record, its own group, application assignments scoped to the one job, and its own credential with a rotation date that lives in a calendar rather than in somebody's memory.
I did this for an agent recently and it took an afternoon. Afterwards I could answer all three questions above, and I could not answer any of them the week before. The process was not novel in any respect. It was joiner mover leaver for something that is not a person.
Where to start
List your agents.
Most organisations cannot produce that list, and the fact that they cannot is the finding. It is not a preparatory step before the real work. It is the result. If nobody can say how many autonomous things hold credentials in your environment, then the number of them that are correctly scoped is not knowable either, and the honest answer to any question about agent security is that you do not know yet.
That answer is fine. It is considerably better than the confident one.
Sources
Product behaviour changes. Everything above was checked against vendor documentation when it was written, and you should re-check before you build anything on it.