Solving Permission Creep in AI Agent Deployments

The Permission Creep Problem

Technical writer Patrick identifies a recurring pattern where AI agents accumulate unauthorized power within 90 days of production. This drift transforms read-only agents into high-risk entities capable of triggering webhooks and database writes without oversight.

Why This Matters

In ideal models, agents follow strict RBAC, but technical reality shows they frequently hit permission edges, leading teams to add reactive access increments for convenience. This scaling of access directly increases the blast radius of a mistake; while a read-only agent drift is merely annoying, an agent with financial or external communication access can cause catastrophic business damage.

Key Insights

• The 90-day drift: Agents typically exceed their intended power within three months of deployment as teams reactively add write and webhook permissions (Patrick, 2026).
• Blast Radius Scaling: Risk levels jump from ‘Recoverable’ for file writes to ‘Catastrophic’ for moving money based on accumulated API keys.
• Identity File Constraints: Utilizing a SOUL.md file allows agents to read their own permission boundaries during every execution turn to prevent context drift.
• The Reload Rule: System reliability depends on the agent reloading its configuration at the start of every session rather than relying on one-time initialization.

Working Examples

Explicit permission block for AI agent identity files to define boundaries.

## Permissions\n### Can do without asking:\n- Read any file in /workspace\n- Write to memory/ and logs/\n- Post to outbox.json\n### Must ask before doing:\n- Writing outside /workspace\n- Sending any external message\n- Making any API call with write access\n### Never do:\n- Send email\n- Make financial transactions\n- Modify SOUL.md or config files\n- Access files outside designated directories

Practical Applications

• System: Monthly permission audits to compare actual API key access against live credentials. Pitfall: Relying on outdated documentation instead of checking actual file paths.
• System: Implementing a ‘Must ask before doing’ category for external API calls with write access. Pitfall: Granting convenience permissions that accumulate over time without a core functional requirement.

References:

• https://dev.to/askpatrick/the-permission-creep-problem-why-ai-agents-accumulate-access-they-were-never-meant-to-have-48c