Least privilege for AI agents means more than a scoped API key

Giving an AI agent a person's administrator credentials is a structural weakness, not a shortcut. Agents behave differently from humans — they can run continuously, select their own tools, ingest untrusted content, and act faster than a person can review — and identity built for people doesn't account for any of that.

Least privilege for a machine identity means more than a scoped API key. It means a unique, attributable identity per agent instance; short-lived credentials instead of persistent secrets; permissions granted just-in-time for the specific approved operation rather than standing access; and scope limited by resource, action, environment, and time — a Monday approval shouldn't authorize a Friday execution.

It also means agents shouldn't automatically inherit all of a human's authority just because that human invoked them. An investigation step and an execution step are different operations with different risk, and should hold different credentials — not the same all-purpose token used for everything.

This is why Changefy's execution runner requests short-lived, scoped credentials sufficient only for an approved plan's specific actions — never a standing high-privilege identity reused across every request.