Highlighted wordsare glossary terms — tap one for a plain-language definition.
A chatbot mainly gives you information. An AI agentWhat it means: An AI system that can use tools or connected accounts to take actions, not just answer questions.Example: An assistant that reads a receipt folder, creates an expense report, and asks before submitting it.What to do: Give it only the access needed for the current task, require approval for important actions, and disconnect it afterward.Important: An agent can act with your permissions, so broad access creates broad risk.What does this mean? can also take actions — reading files, sending messages, changing code, making purchases, or using connected accounts. The more an AI can access and act, the more carefully you must limit its permissions. [1, 2]
Access turns answers into actions
The important difference is authority. A normal chat cannot independently enter your accounts. Risk rises when an agent receives tools, credentials, internet access, or permission to act. In 2026, Anthropic documented four incidents in specially configured cybersecurity evaluations where models reached real external systems after an isolation failure. These were research environments running without ordinary safeguards — not everyday chatbot conversations escaping on their own. [1]
- Ask what the agent can read, change, send, buy, or delete.
- Treat every connected account as a real permission, not a convenience toggle.
- A claim such as 'read-only' does not make broad access necessary or harmless.
Use four guardrails
Use one rule whenever an AI can act: limit, approve, observe, revoke. OWASP identifies excessive autonomy, tool abuse, and high-impact actions without human oversight as agent risks. Its guidance calls for Least privilegeWhat it means: Giving a person, app, or AI only the minimum access needed for a specific task.Example: Sharing one receipt folder instead of an entire email account and cloud drive.What to do: Choose the narrowest folder, account, and permission that can complete the task.Important: Read-only access can still expose sensitive information that the task never required.What does this mean?, explicit approval for consequential actions, monitoring, and a way to stop an agent. [2, 3]
- Limit: give access only to the files, accounts, and permissions needed now.
- Approve: require confirmation before sending, publishing, purchasing, deleting, deploying, or changing an account.
- Observe: review logs, sent messages, purchases, and account changes.
- Revoke: disconnect the agent and remove temporary access when the task ends.
Keep high-impact accounts behind stronger boundaries
Some connections can expose money, identity, health information, recovery access, or an entire organization. Do not connect them without narrow permissions, clear approval points, activity records, and a tested way to disconnect access. [2, 3]
- Banking and payment accounts
- Password managers and primary email
- Health portals and cloud-administrator accounts
- Domain registrars and work systems containing personal or confidential information
Why Hygi. recommends this — the guidance above follows these published sources:
Anthropic
An alignment assessment of recent cybersecurity incidents(opens in a new tab)Published September 9, 2026. Four incidents in specially configured cybersecurity evaluations and their context.
OWASP Foundation
AI Agent Security Cheat Sheet(opens in a new tab)Least privilege, human oversight, monitoring, tool controls, and excessive autonomy risks.
OWASP Foundation
AI Security Verification Standard — Orchestration and Agentic Action(opens in a new tab)Approval controls, reversibility, interruption, and high-impact agent actions.
NIST National Cybersecurity Center of Excellence
Accelerating the Adoption of Software and AI Agent Identity and Authorization(opens in a new tab)Initial public draft, February 5, 2026. Agent identity, authorization, and least-privilege challenges.
Brought to you by NorthBridge
Unfamiliar term? Open the Digital Safety Glossary