Governing AI agent access, credentials and permissions

For two years the question about AI agents was "can it do the task?" This week it became "what is it allowed to touch while doing it?" A security vendor was reported to be negotiating a large purchase of a company that manages machine credentials, including those used by AI agents. One of the world's biggest banks narrowed who may use AI coding tools. And a law professor watched an agent delete a year of lecture notes during a small chore.

None of these stories is about model quality. They are about access: identities, permissions, scopes and the ability to undo. If you build or run agents, this is now part of your job, just as database permissions became part of every backend engineer's job. Most of the tools already exist in ordinary identity and access management.

What happened

Palo Alto Networks reported to be in talks to buy Clutch Security

On 4 November 2026, The Information reported that Palo Alto Networks is in talks to acquire Clutch Security for about $500 million, citing people familiar with the negotiations. Calcalist followed on 5 November. This is a reported deal, not an announced one. Palo Alto told The Information it does not comment on "rumors or speculation", and Clutch did not respond to requests for comment. The talks may not lead to a deal.

Clutch is an Israeli start-up founded in late 2023 by Ofir Har-Chen (CEO), Sagi Haas (CTO) and Tal Kimhi (VP of R&D). It works on non-human identities: API keys, service accounts, tokens and passwords used by software. According to Calcalist, its platform maps these identities, flags excessive or exposed permissions, manages credentials over their lifecycle, detects suspicious activity, and is being extended to AI agents. Clutch has raised about $28.5 million: an $8.5 million seed round in July 2024 led by Lightspeed Venture Partners, and a $20 million Series A in January 2025 led by SignalFire. Calcalist notes that Palo Alto recently completed its $25 billion acquisition of identity security company CyberArk, and that a Clutch deal would be its fifth announced acquisition this year.

Goldman Sachs limits AI coding tools to engineers

On 2 November 2026, Bloomberg reported that Goldman Sachs has restricted most traders and bankers from using AI coding tools, including Anthropic's Claude Code and Microsoft's GitHub tools, under internal guidance updated in October. Some outlets name the GitHub product as GitHub Copilot; FStech, summarising Bloomberg, says "Microsoft's GitHub". Access is now limited to engineers. The "strats" group, whose roles mix trading, quantitative research and software engineering, is not affected.

According to the reports, traders and bankers had used the tools for several months to monitor client trading flows, model potential market moves and produce written and visual content. A Goldman spokesperson said the firm assessed productivity and risk during a period of experimentation and wanted to put the tools "in the hands of those who are best suited to leverage them for the long term." The reporting notes Goldman has an engineering workforce of roughly 12,000.

An agent deletes a professor's syllabus during a renumbering task

On 5 November 2026, William Baude, a law professor at the University of Chicago, posted on X that "while I was at lunch, Claude deleted a year of con law lecture notes and my current syllabus." He had asked the assistant to update page numbers in an old set of lecture notes. The assistant's message, shown in his screenshot, said: "I deleted your Fall 2026 FINAL syllabus .docx and all top-level Class N 2023 notes by accident, and they are not restored." Baude said he recovered everything "thanks to Dropbox" and shared the story as a public service announcement. Tom's Hardware and Dexerto reported it.

The reports do not say which Claude product or model was involved, what caused the deletion, or whether an approval prompt appeared. The lesson does not need more: an agent with delete access did something nobody asked for, and a system outside its control saved the work.

How agent access works: identities and permissions

Two questions are often blurred: identity (who, or what, is acting?) and authorisation (what may it do?). Agents make both harder.

Non-human identities

A non-human identity is anything other than a person that authenticates to a system: a CI pipeline that deploys code, a cron job that reads a database, an API key pasted into a script. Most companies have far more of these than human accounts, and they are often poorly tracked.

Think of a block of flats where, over the years, spare keys go to cleaners, plumbers and a delivery service. Nobody keeps a list, and some keys open every door. That pile of untracked spare keys is what non-human identity tools try to inventory and clean up.

AI agents are a fast-growing kind of non-human identity. A coding agent may hold a GitHub token, a cloud credential and a database password at once. An office agent may reach your mail, calendar and files. Unlike a cron job, an agent decides what to do next at run time, so its behaviour is less predictable. That is why vendors now treat agent credentials as their own category. The site's page on agent identity and delegation covers the identity models in more depth.

Least privilege

Least privilege means giving an identity only the permissions its task needs. A hotel key card opens your room and the gym for your stay, then stops working.

For agents, least privilege has three dimensions:

Resources. Which repositories, folders, tables or mailboxes can it reach? A renumbering task needs one folder, not your whole drive.
Actions. Read, write, delete, send, merge, deploy? Most tasks need far fewer verbs than people grant by default.
Time. How long does the permission last? A permission that ends with the task limits the damage of any mistake or leak.

The Goldman story is least privilege applied to people and tools. Instead of every employee having a powerful coding agent, the bank limited it to the groups it judged best placed to use it. The shape of the decision is classic access control.

Scoped, short-lived tokens

The practical tool for least privilege is the token. Instead of handing an agent a password or a broad API key, you issue a token with specific scopes, such as read access to one repository, that expires quickly.

Consider a car valet key. It starts the car but does not open the boot, and you get it back at the end of the evening. A long-lived, all-powerful API key is the opposite: the full key ring, never returned, copied into every log it passes through. If hostile text tricks an agent into printing its credentials, a token that expired ten minutes ago is worth little. The guide to prompt injection defence explains why you should assume an agent will eventually read hostile text.

Delegation: acting on behalf of a user

Often an agent should act for a specific person: read my mail, open a pull request in my name. Two bad ways to do this are giving the agent the user's password, or a shared service account that can act as anyone.

The better pattern is delegation, usually through OAuth. The user approves a request, and the agent receives a token meaning "this agent may do these things on behalf of this user, until this time." Token exchange, standardised in OAuth as RFC 8693, goes further: a token held by one service is swapped for a narrower one that records both the user and the acting agent. Microsoft calls a similar flow "on-behalf-of".

The everyday version is a signed letter of authority. A friend collects a parcel for you with a dated letter naming them and the parcel. It does not open your bank account. Good delegation tokens name who is acting, for whom, for what and until when. That matters for audit, because "the agent did it" is not an answer a post-incident review will accept. See OAuth for tool access for the flows, and the Model Context Protocol page for how tool servers commonly handle authorisation.

How agent access works: containment, reversibility and records

Permissions decide what an agent may do. Containment decides how much harm it can do when it gets something wrong anyway. Agents will make mistakes. The design question is whether a mistake costs ten seconds or a year of work.

Sandboxing

A sandbox is an isolated environment where an agent can run commands without reaching the rest of the system: a container, a virtual machine, a separate cloud account or a temporary copy of a repository. Inside, the agent can delete anything; outside, nothing changes. It is like a test kitchen, where a failed recipe never touches the restaurant's service. For coding agents, that means a fresh workspace with only the files they need and network access limited to the hosts they must reach. The sandboxing page covers the options.

Reversible actions

The Baude story ended well because of a sync service's copies. That was luck, not design. Reversibility should be built in:

Prefer soft deletes. Move files to a trash folder or mark rows deleted instead of removing them.
Work on copies or branches. A coding agent commits to a branch, not main. An office agent writes a new version rather than overwriting the only one.
Snapshot before bulk changes, in a place the agent cannot delete.
Keep backups outside the agent's reach. If the agent's credentials can delete the backup, it is not a backup for this purpose.

You type boldly in a word processor because undo exists. Reversibility lets you give agents more freedom safely, because the cost of an error is bounded.

Why destructive tools need confirmation

Some actions cannot be undone or are costly to undo: deleting data, emailing customers, moving money, force-pushing over history, changing access rights. For these, the agent should stop and ask a human.

The reason is arithmetic. Even an agent that picks the right action almost every time takes many actions in a long session, and small error rates add up across steps. A confirmation for the few destructive actions costs seconds of attention and removes the tail risk, like a bank asking you to confirm a payment to a new recipient.

Two warnings. Confirmation only works if the request is specific: "Delete 47 files in /Lectures/2023, listed below?" is useful; "Allow file operations?" is not. And prompts that fire too often train people to click "yes" without reading, so reserve them for destructive or external actions. The pages on human-in-the-loop design and guardrails cover patterns and automatic pre-call checks.

Updating page numbers is a read-and-edit job. No step requires deleting a file. An agent without a delete permission, or one that had to ask before deleting, would very likely not have caused that incident.

Audit trails

An audit trail records who did what, when, with which permission. For agents, that means the user who started the task, the agent's identity, each tool call with its arguments and result, and the scope used. Like a visitor log, it matters most on the day something goes missing. Logs also make permissions reviewable: if an agent has held delete rights for three months and never used them, remove them.

What it means in practice

Agent access is becoming a separate security market. The reported Clutch talks, after the CyberArk acquisition, signal that large vendors see machine and agent identities as a gap human-focused identity tools do not fully cover. Whether or not this deal closes, expect your security team to ask for an inventory of agent credentials.

Rollouts will be narrower and more deliberate. The Goldman decision shows that organisations which gave powerful agents to many staff during experimentation may pull back to the groups who use them safely and productively. Plan rollouts around roles and risk from the start, rather than granting broad access and clawing it back.

Office agents carry the same risks as coding agents. An agent with access to a synced folder, mailbox or shared drive can do damage comparable to one with a shell. The guides to computer use and browser agents cover the extra risks when an agent drives a desktop or browser.

"Who did this?" must have an answer. Under a user's full account, every agent action looks like the user's own. Delegated tokens that name the agent fix this.

Zero trust applies to agents. The zero trust principle of verifying every request fits agents well: a delete request should be checked against policy each time, even if reading the same folder was allowed a minute earlier.

What to do now

Inventory agent credentials. List every agent in use, the identity it runs as, and every token, key or account it can reach, including office assistants and browser extensions.
Give each agent its own identity. Stop running agents under personal accounts or shared admin keys; use delegated tokens that record both user and agent.
Scope by resource, action and time. Grant specific folders, repositories or tables, only the verbs the task needs, and tokens that expire quickly.
Remove delete and send rights by default. Make destructive and external actions opt-in per task.
Require specific confirmation for irreversible actions. Show the exact files, recipients, amounts or commands, and keep prompts rare enough that people read them.
Run coding agents in sandboxes. Use fresh containers, restrict network access, and have agents work on branches with human review before merge.
Design for undo. Turn on version history for shared drives, prefer soft deletes, snapshot before bulk operations, and keep backups outside the agent's credentials.
Log every tool call with user, agent, tool, arguments, result and scope, somewhere the agent cannot edit.
Review permissions regularly. Remove unused scopes, rotate keys and revoke tokens for retired agents.
Decide who may use which agent, write down why, and revisit after a trial period using your logs, as part of your AI governance policy.
Rehearse an incident. If an agent deleted a shared folder today, how fast could you restore it, and how would you know which agent did it?

Risks and open questions

The Clutch deal is unconfirmed. It rests on a report from The Information and a follow-up from Calcalist. Neither company has confirmed it, and price and terms could change. Treat it as a signal about market direction, not a fact about a transaction.

The Goldman details come from press reports of internal guidance that Bloomberg saw and the bank has not published. Reports differ on whether the restricted product is GitHub broadly or GitHub Copilot, and we do not know what specific data drove the decision.

The Baude incident lacks technical detail. We do not know the product, its permissions, whether a prompt appeared, or how the deletion happened. It is one user-reported case, not evidence of how often such errors occur.

Least privilege has a cost. Tight scopes and frequent prompts slow agents and frustrate users, as some Goldman traders reportedly felt.

Standards are still settling. OAuth delegation is mature, but conventions for agent identities in tokens and for agent-to-agent delegation are still evolving.

What to watch next: whether Palo Alto announces the Clutch acquisition, whether other regulated firms adopt similar role-based rules, and whether agent vendors make delete and send actions require confirmation by default.

Frequently asked questions

What is a non-human identity?

It is any account or credential used by software rather than a person: service accounts, API keys, tokens, certificates and the credentials AI agents use to reach other systems. They often outnumber human accounts and are rarely reviewed. Agents are a growing share of them, and less predictable than traditional automation because they choose their next action at run time.

Why not just let an agent use my own account?

Because the agent can then do everything you can, and every action looks like yours in the logs. If it makes a mistake or is manipulated by hostile text, the damage is limited only by your own permissions. A delegated token that names the agent and covers only the task limits the blast radius and keeps the record clear.

Are confirmations enough to make agents safe?

No. They help for a small set of irreversible actions but rely on a human reading carefully, and people stop reading prompts that appear too often. They work best alongside narrow permissions, sandboxes and reversible designs, so most mistakes are impossible or easy to undo.

What is the difference between least privilege and sandboxing?

Least privilege limits what an identity may do, such as reading a folder but not deleting it. Sandboxing limits where its actions have effect, by isolating it. One stops harmful actions on real systems; the other contains whatever gets through.

Does this apply to office agents or only to coding agents?

Both. Office agents that read and write files, send email or edit shared documents can cause harm comparable to coding agents, as the deleted syllabus shows. Give them their own identities, scope their folders and mailboxes, and protect important files with version history.

Summary

This week showed that AI agent access has become a security problem in its own right. Palo Alto Networks was reported to be in talks to buy non-human identity company Clutch Security for about $500 million; Goldman Sachs reportedly limited AI coding tools such as Claude Code to engineers after a productivity and risk review; and a University of Chicago law professor recovered a deleted syllabus and lecture notes only because Dropbox kept copies. The fixes come from established identity practice: give each agent its own identity, scope access by resource, action and time, use short-lived delegated tokens, sandbox it, make actions reversible, require specific confirmation for destructive steps, and log everything.

Governing AI agent access with scoped credentials and undo buttons