GOV-04: Least privilege at creation
In short: Grant each new agent only the permissions its documented purpose needs, at the moment its identity is created. Agents rarely lose access once granted. Starting narrow is far easier than trimming later, and it limits damage if an agent is hijacked or misused.
1GOV-04
What does GOV-04 require?
Grant each new agent only the permissions its documented purpose needs, at the moment its identity is created.
Why does it matter?
Agents rarely lose access once granted. Starting narrow is far easier than trimming later, and it limits damage if an agent is hijacked or misused.
How do you test it?
- Create a test agent and inspect the permissions it receives by default.
- Compare those permissions with its purpose statement.
- Confirm broad scopes need a separate, recorded approval.
Which platforms document GOV-04?
Documented by Astrix Security.
- 7.30Astrix Security documentedSource: Astrix at RSAC 2026, read
- 9.10NewCore partly documentedSource: NewCore: Secure, read
- 7.30Cyera Identity partly documentedSource: Oasis Agentic Access Management, read
- 6.55Token Security partly documentedSource: Token Security home, read
- 8.35Silverfort not found in public materialChecked: Silverfort: AI Agent Security; Silverfort unveils AI Agent Security; Silverfort and Google Cloud Agent Gateway; Silverfort pricing, read
- 6.85Descope not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- 6.55Aembit not found in public materialChecked: Aembit home; Aembit IAM for Agentic AI is generally available; Aembit pricing, read
- 6.55SailPoint Entro not found in public materialChecked: SailPoint agentic AI security; SailPoint closes Entro Security acquisition, read
- 6.35Clutch Security not found in public materialChecked: Clutch Security platform, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
No framework mapping is confirmed for this control yet. See the framework crosswalks for what we checked.
Which controls are related?
- GOV-03Documented purpose
- GOV-05Short-lived credentials
- GOV-18Delegation bounded by the person's permissions
Glossary: purpose statement, least privilege.
Reviewed by The Register desk