Topic
A security principle under which each identity or component holds only the permissions its task requires, limiting how far any single compromise reaches.
Databricks made on-behalf-of-user authorization generally available in Databricks Apps, so queries run under the signed-in user's Unity Catalog permissions. Row filters and column masks apply without app code, so the builder's remaining job is choosing which identity each request carries.
Reality
Microsoft says Storm-3168 used a compromised service principal to delete Azure storage accounts, a Key Vault and an App Service plan in about seven minutes. The deletions ran on roles it already held, so role scope and locks had to exist before the credentials leaked.
Reality
Coding-agent teams should move their top three irreversible actions behind checks outside the model, a dev.to guide argues, because prompt rules are advice. The argument rests on how prompts are wired, and the post's own release advice weakens one of its three objections.
Reality
JFrog has documented an on-behalf-of exchange so agent calls reach Artifactory as the signed-in user. The price is the Gateway's cached tool search, which per-user discovery gives up.
Reality
Only 36% of IT staff in an Automox survey feel highly confident in their endpoint compliance visibility, as AI agents start acting on managed devices. Agents inherit their launcher's rights, so teams now need a record of what each may do and what it did.
Reality
MetTel CTO Ed Fox says AI agents need scoped permissions and audited trajectories, citing sandbox lapses involving Anthropic, OpenAI and Moonshot AI models. His privileged-user model handles access granted by mistake, but agents that try another route when blocked need monitoring built for that behavior.
Reality
A Python tool called zombiescan sweeps every enabled AWS region in about 20 seconds using only Describe, List and Get calls, and the one sample run its guide publishes returned 86 findings that all price at zero dollars a month.
Reality
A dev.to walkthrough puts the spend limit in an Azure Policy deny rule bound to one resource group, with a two-SKU allow list and a custom RBAC role whose only actions are read and restart. The gate declines the request at deployment time.
Reality
The SANS 2026 survey puts 74 percent of businesses on standing credentials for autonomous AI, with no single control above 40 percent. The two MCP incidents most often cited as proof have different root causes.
Reality
A retrospective on oioannou.com describes an agent that began with read-only ClickHouse access in January 2026, grew into Slack, Linear, PostHog and Grafana through thin CLI wrappers, and now consumes billions of tokens a month.
Reality
The Australian Signals Directorate has published guidance placing agentic AI's enforcement point in the harness, the software layer that decides which tool calls run and with what permissions. Its remedies are configuration and logging.
Reality