Definition
Security controls that specifically govern what an AI agent is permitted to do with the tools and data it can reach — limiting each agent to only the actions and information required for its current task, and logging every action for audit. It extends traditional user-permission systems to the new reality where the 'user' is an autonomous AI.
Why it matters
Without fine-grained access controls, AI agents inherit the broadest permissions available, creating enormous blast radius if they are compromised or misbehave. Regulatory guidance from CISA and the US Congress now specifically calls out agentic access control as a required federal security control.