If your organization runs AI agents in production and you're confident they're operating with least privilege but can't prove it in the next ten minutes, you have a governance problem disguised as a policy issue.
Research from Cequence Security and Enterprise Management Associates reveals a troubling gap: 94% of organizations believe their AI agents don't have excessive access, yet only 33% actually enforce least-privilege controls. This isn't just theoretical. 65% have experienced agents acting beyond their intended scope, with 29% reporting measurable business impact.
This template provides a structured authorization review you can implement immediately, before your next agent incident occurs.
Purpose of the Template
This AI agent authorization audit template helps you inventory every AI agent in your environment, validate the permissions each agent holds versus what it was intended to have, and identify where agents have inherited permissions from their creators instead of operating under defined access controls.
The template addresses three key questions:
- What agents are currently running?
- What can each agent do versus what it was designed to do?
- Is the agent operating on defined access or inherited permissions?
As Randolph Barr from Cequence Security highlights, agents often inherit permissions from their creators, giving them more reach than intended. This template identifies those inheritance patterns before they cause problems.
Prerequisites
Before starting this audit, ensure you have:
- Access to identity and access management logs showing agent creation events, permission grants, and authentication attempts over the past 90 days.
- A clear definition of "AI agent" for your environment, including autonomous workflow tools, API-connected LLM instances, robotic process automation with decision logic, and any service account making decisions without per-action human approval.
- Stakeholder availability from teams that create or manage agents: IT operations, development, data science, and business process owners. You'll need 15 minutes with each to validate scope.
- Documentation of intended agent scope, if available. Many organizations find they never documented what an agent was supposed to do, which is itself a finding.
The Authorization Audit Template
Copy this table structure into a spreadsheet. One row per agent.
| Agent Name | Owner/Creator | Business Function | Creation Date | Last Activity | Intended Scope | Actual Permissions | Permission Source | Scope Deviation | Risk Rating | Remediation Owner | Target Date |
|---|
Field definitions:
- Agent Name: The identifier in your IAM system, not the friendly name.
- Owner/Creator: The person or team who deployed it. If this field says "unknown," stop and find out.
- Business Function: What problem was this agent built to solve? One sentence.
- Creation Date: When the agent identity was provisioned.
- Last Activity: Most recent authentication or action. Agents inactive for 90 days are candidates for deprovisioning.
- Intended Scope: What systems, data, or actions was this agent designed to access? Reference the original request ticket or design doc.
- Actual Permissions: What can this agent do right now according to your IAM system? List every permission grant, role assignment, or group membership.
- Permission Source: Did this agent receive explicit grants, or did it inherit permissions from its creator's account, a service account, or a group? Mark "inherited" or "explicit."
- Scope Deviation: Does the actual permission set exceed the intended scope? Yes/No. If yes, describe the delta.
- Risk Rating: High if the agent can modify production data, access Personally Identifiable Information, or execute financial transactions. Medium if read access to sensitive systems. Low if sandboxed or non-production only.
- Remediation Owner: Who will right-size this agent's permissions?
- Target Date: When will remediation be complete? Default to 14 days for high-risk deviations.
Customizing the Template
- Add columns for compliance requirements. If you're subject to the Sarbanes-Oxley Act or HIPAA Security Rule, add a column tracking whether the agent accesses in-scope systems. ISO/IEC 27001 shops should add a column for the control objective each agent supports.
- Adjust risk ratings to your risk appetite. If your organization treats API access to customer data as high-risk regardless of read/write, mark it that way. The template uses a three-tier model; expand to five tiers if your Risk Management Framework requires it.
- Include detection capability. Add a column for "Time to Detect Out-of-Scope Action." Research found 32% can detect and quarantine unauthorized agent behavior within minutes via automated controls, while 55% require hours and manual investigation. If you can't answer this question for an agent, that's a control gap.
- Track external connectivity. 14% of organizations allow agents to connect to outside tools and data sources without restriction. Add a column for "External Connectivity" and mark whether the agent can reach third-party APIs, SaaS platforms, or internet resources. If yes, document what approval process governed that decision.
- Separate human-approved actions from autonomous actions. Not every agent operates fully autonomously. Add a column for "Approval Model" with values: fully autonomous, human-in-the-loop for high-risk actions, or human approval required for all actions. This maps to the finding that 34% evaluate authorization at the moment an agent attempts an action.
Validation Steps
- Run the audit. Schedule two hours. Pull your IAM logs, identify every non-human identity that has authenticated in the past 90 days, and populate the template.
- Cross-check with business owners. For every agent, send the "Intended Scope" and "Actual Permissions" fields to the listed owner. Ask: "Does this match what you expected?" You'll find agents that were supposed to be deprovisioned months ago still running with live credentials.
- Measure the gap. Count how many agents show "Yes" in Scope Deviation. That's your governance gap. If it's above 25%, you have a systemic problem with how agents are provisioned.
- Test detection controls. Pick one medium-risk agent and simulate an out-of-scope action. Can your monitoring tools detect it? How long does detection take? If you can't test this safely, you don't have effective detective controls, which means you're operating on trust.
- Review quarterly. Agent sprawl accelerates. What's accurate today won't be in three months. Put this audit on your quarterly control testing calendar, and assign an owner who isn't the same person creating the agents.
The gap between AI governance policy and enforcement is a critical risk. This template won't write your policies, but it will show you whether the policies you have actually constrain what your agents can do. Start there.
