A company is building an AI system that will access multiple enterprise systems (email, calendar, CRM, ERP) to autonomously complete tasks on behalf of employees. The CISO flags that the AI agent's access permissions are as broad as the highest-privileged user in the system. Which security principle is being violated?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because granting an AI agent the same permissions as the highest-privileged user violates the principle of least privilege, which requires that any system or user be given only the minimum permissions necessary to fulfill their function. An overprivileged AI agent dramatically expands the blast radius of any error, hallucination, or prompt injection attack.
Full explanation below image
Full Explanation
B is correct because granting an AI agent the same permissions as the highest-privileged user violates the principle of least privilege, which requires that any system or user be given only the minimum permissions necessary to fulfill their function. An overprivileged AI agent dramatically expands the blast radius of any error, hallucination, or prompt injection attack. Defense in depth (A), separation of duties (C), and non-repudiation (D) are all relevant security principles for agentic AI, but the specific violation described — having permissions of the highest-privileged user — is a least privilege violation.