SSOGEN / Free tools / AI Agent Permissions: A Free Builder to Draft Least-Privilege Scopes
Free tool
AI Agent Permissions: A Free Builder to Draft Least-Privilege Scopes
AI agent permissions should be a short list of named scopes granted to a registered identity, with a person approving the dangerous ones. This free builder drafts that list in your browser, and the page shows how to review it.
Draft your agent’s permissions here
Free, in your browser. Describe the agent: name, application, whether it acts for a person or on its own, and owner. Then list its tools and, for each, the most powerful thing it can do. Select Build the permissions.
You get these results:
- Scopes. A scope catalogue.
- Warnings. Review warnings.
- Settings. The settings to apply when you register the agent.
- Claims. A sample of the credential’s claims.
- Audit trail. A sample audit trail.
- JSON. A JSON definition to copy or download.
Load an Acme example fills in the Invoice Assistant used further down. The page makes no network request.
Tools the agent calls
One row per tool. Pick the most powerful thing the tool can do, not the most common.
Private by design. Everything is built in this page and nothing is uploaded. The suggestions are a starting point for your own review, not a security assessment.
The builder follows the model SSOGEN uses for AI agent access control. The ideas below hold for any system that gives agents their own credentials.
How agent permissions work
AI agent permissions work best as a short list of named scopes, granted to a registered identity that has an owner. A person approves the dangerous ones the moment they happen.
- Free and private. The builder above drafts that list: it’s free, runs in your browser, uploads nothing and needs no sign-up.
- Roles are too coarse. Roles alone are too coarse for an agent that can both read and cancel; see RBAC vs ABAC.
How to choose the scopes
A scope is a named permission, defined on the application, that an agent can be granted. Four habits keep the list short and easy to review.
- One scope per tool and action. A tool that can read and delete gets two scopes, not one. You can’t narrow a grant you can’t split.
- Name by resource and action.
invoice.readtells a reviewer, an approver and an auditor what it does.agent-accesstells them nothing. - Start from read. Grant read, run the agent, and add a write scope only when a real task fails without it.
- The most powerful action decides the scope. A tool that “looks up a vendor” but can also change its bank details is a write tool. Classify every tool by the worst thing it can do. A mistaken or manipulated agent will get there eventually.
Example: split one agent into a reader and a writer
Acme Corp starts with one agent that answers invoice questions and also fixes mistakes. It holds read, create-draft and cancel scopes together, so a prompt that tricks the question-answering side can cancel invoices. Split it:
| Agent | Scopes | Owner |
|---|---|---|
| Invoice Reader | invoices.read, invoice.read |
Maria Lopez |
| Invoice Drafter | draft-invoice.write |
Maria Lopez, plus one backup owner |
You can give the reader to many people and review it lightly. Review the drafter more often, and stop it on its own if needed. Cancelling and paying stay with people, as the next section explains.
Which actions deserve a human decision
Some actions should wait for a person at the moment they happen. A quick test: if you can’t undo a mistake in a minute, or one mistake costs more than you’d let a new hire spend unsupervised, a person decides.
| Kind of action | Reversible? | Who decides |
|---|---|---|
| Read information | Yes | The scope grant is enough |
| Create a draft or a reversible change | Yes | The scope grant is enough, with review of the draft |
| Delete or cancel | Rarely | A person, each time |
| Approve or move money | No | A person, each time |
| Change access or settings | Hard to see, easy to abuse | Avoid giving it to an agent; if you must, a person, each time |
| Send a message outside the company | No | A person, each time |
In SSOGEN you mark such a scope Sensitive. The agent’s request is held until the person approves or denies it on their Approvals page, after a recent strong sign-in. Sensitive scopes are never part of a stored delegation.
The honest limit of an approval
An approval gives the agent a short window to use that scope. It doesn’t approve one particular operation. SSOGEN doesn’t see what the agent does with the window, and the approval page tells the person so.
Say an agent is approved to “approve payments”. The approval doesn’t say “this payment, this amount”.
Put the second limit inside the tool itself: amount caps, allow-lists of payees or recipients, rate limits and a dry-run mode.
Permissions say who may try. The tool decides how far.
Acting for a person or on its own
SSOGEN registers an agent in one of two modes, and the mode changes what its permissions mean.
| Mode | What it means for permissions |
|---|---|
| Acts for a person | The agent works for someone who agreed on a consent screen. A delegation lasts at most 30 days and never beyond the agent’s own expiry. Effective access is the part of the grants that the person allowed and still has, so the agent never gets more than that person. |
| Acts on its own | The agent has its own authority. It needs a passing Test access before it can be activated, and a person must be able to answer any approval request it raises. |
The person can withdraw a delegation in My Account, and an administrator can revoke it. Whenever a human’s rights should bound the agent, pick acting for a person.
The settings that keep an agent accountable
Scopes are only half the control. These settings come from the registration wizard in the AI agent registration guide.
- Named owners, up to five. People, never groups, with one primary. If the last owner leaves, the agent is suspended automatically.
- A review or expiry date within 365 days. An agent nobody reviews by its review date is suspended.
- A key pair instead of a password. You register the public key; the agent keeps the private key. SSOGEN refuses a registration that contains a private key.
- Credentials of about four minutes, tied to the agent’s key, so a copied token is of little use to anyone else. The DPoP proof checker shows what that binding looks like, and the JWT decoder reads the claims.
- A kill switch per agent type. It suspends every active agent of one type at once and blocks activating others of that type until you release it.
- An audit trail. SSOGEN records registrations, tokens issued or refused, delegations, approvals and suspensions, without tokens or keys.
For the wider picture, see AI agent identity and the AI agent governance explainer. For permissions per tool on a tool server, see MCP tool permissions.
Twelve questions to review an agent’s permissions
Run these on the builder’s output, and again at every review date.
- Can I state in one sentence what this agent is for?
- Does every scope trace to a tool the agent really calls?
- Is each scope the narrowest one that lets that tool work?
- Did I classify each tool by its most powerful action, not its name?
- Could any scope be removed by splitting the agent in two?
- Which actions are irreversible, and are all of them Sensitive?
- If an approval is given, what is the largest harm in its short window, and does the tool cap it?
- Does the agent act for a person, so a person’s rights bound it?
- Are there at least two owners, and are they people who will notice a problem?
- Is there a review or expiry date, and who is booked to do the review?
- Is a stolen token useless without the agent’s key, and is the lifetime minutes, not days?
- If this agent misbehaves tonight, who pulls the kill switch, and have they done it before?
Outside guidance agrees. The OWASP Top 10 for Agentic Applications 2026 lists identity and privilege abuse among its ten risks (read 2026-10-08 as a listing page; the full document is a download).
Read it next to your list, and see agentic AI security for how these risks arise.
A worked example: one invoice agent from scopes to audit
The sample button fills in Acme Corp’s Invoice Assistant. It acts for a person, is owned by Maria Lopez, and works on the Acme Invoices application. Its five tools and the builder’s output:
| Tool | Most powerful action | Scope | Mark as |
|---|---|---|---|
list_invoices |
Read | invoices.read |
Normal |
get_invoice |
Read | invoice.read |
Normal |
create_draft_invoice |
Create or change | draft-invoice.write |
Normal |
cancel_invoice |
Delete or cancel | invoice.delete |
Sensitive |
approve_payment |
Approve or move money | payment.approve |
Sensitive |
Delete and approve default to Sensitive. The builder also warns that an approval covers a short window, not one operation.
The credential it sketches carries these claims:
sub. The person.act. The agent.aud. The audience.scope. The three Normal scopes.exp. 240 seconds afteriat.cnf.jkt. The thumbprint of the agent’s key.
The two Sensitive scopes are missing by design. They appear only after Maria approves a request.
A sample audit trail from the builder reads like this:
| Event |
|---|
| Agent registered (pending): Invoice Assistant, owner Maria Lopez |
| Agent activated by an administrator |
| Token issued to Invoice Assistant for Acme Invoices; scopes: the three Normal scopes |
Approval requested: Invoice Assistant wants invoice.delete for Maria Lopez |
| Approval granted by Maria Lopez (short window) |
Call to list_invoices refused: scope not granted |
That last line is a refusal being recorded, exactly what you want when a call falls outside the grant.
To register a real agent like this, follow the registration guide, which walks the same Invoice Assistant through step by step. More free browser tools are in Free tools.