How much permission should an agent get?

That’s a genuine tension, and you’re not alone in feeling it. Makers experience friction as “the bot can’t help”; Security experiences the same request as permanent standing access with a friendly face.

Here’s what’s happening. Many Copilot Studio connectors run on-behalf-of (OBO) the signed-in user — the agent acts with that person’s existing rights, and audit trails should attribute actions with agent context. Autonomous patterns lean on application permissions, which is a different blast radius. Microsoft’s Entra Agent ID guidance is explicit: prefer delegated scopes when they suffice; use client-credentials only for true autonomy; avoid privilege creep on blueprints; monitor sign-in logs. Admins can further constrain connectors with Power Platform DLP and advanced connector policies, and register agents for block / reassign / delete via the agent registry.

This is Schofield’s Third Law in organisational clothing: the easier you make it for the agent to reach mail and sites, the easier a compromised or poorly scoped agent reaches them too. 12 Panes puts permissions before autonomy — Pane 04 Security before broad maker freedom.

Practical options, ranked how I’d approach it:

1. Start delegated, purpose-scoped. One agent, one job, connectors limited to the minimum Graph/SharePoint scopes, user consent or admin consent reviewed, DLP policy attached. Simple and auditable.
2. Environment segregation. Dev/test agents in a locked environment; production publish only after Security review and an owner in the AI / agent register. Moderate; stops “useful in personal environment” from becoming tenant-wide.
3. App-only autonomy. Only when the task truly cannot run as a user, with managed identity or certificates (not long-lived secrets), Conditional Access for agents where available, and a break-glass owner. Advanced — treat as privileged access.
4. Wide Sites.Read.All “for convenience”. Sounds efficient; in practice it is overshare amplification with a chat UI. I’d discourage this until SAM/Purview hygiene is credible.

The caution: Publishing attaches API permissions to the agent’s identity for each connector. Review those scopes in Entra; don’t assume the maker’s intent equals the granted surface. Product capabilities change — re-check Learn for Agent ID and Copilot Studio auth when you implement.

I’d suggest a standing rule: no production agent without a named owner, purpose, risk tier, approved connectors, and a reclaim date. Autonomy is earned after Steady holds, not granted because the demo looked clever.

Once that fence exists, makers can move faster inside it — and you’ll sleep better.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer