Agent tool permissions often have no smallest sufficient grant
Incomparable Minima in Agent Tool Authorization
Cryptography and Security
Summary
When software agents need permission to use tools, it’s hard to say which permission is the smallest that still allows the task to get done. The authors looked at Microsoft and Google’s public authorization data and found many cases where there is no single smallest permission, because different minimal permissions cover different parts of what’s needed. Without a clear way to rank these permissions, it is tricky to decide which grants are less powerful or safer. They suggest reporting which minimal grant an agent uses and showing alternatives to those who approve permissions.
What this means in practice
- •For security engineers: Identify and present alternative minimal permission grants when approving agent tool access to reduce over-privilege risks.
- •For api developers: Design API permission models with awareness that a single smallest grant often doesn’t exist, improving fine-grained access control.
Authors
Xin Xu
Abstract
An agent that needs a tool needs authority to call it, and every proposal for governing that authority has to answer one question: of two grants that both let the agent finish a task, which one is smaller? Over-privilege benchmarks score agents against this answer, and permission solvers compute it. We check the question against the authorisation tables that Microsoft and Google publish, covering 22,305 Microsoft Graph endpoint bindings and 23,852 Google API methods, on tasks generated from each table's own resource structure. For 29.8-33.3% of Graph tasks and 3.2% of Google resource tasks the question has no answer, because the minimal sufficient grants form an antichain, a set of grants none of which authorises a subset of what another does. In its two main authorisation modes, Microsoft's shipped privilegeLevel rates 67.4-74.4% of these incomparable pairs equal. Google ships no such scale, so on Google we apply a reconstruction of the FORTIS privilege ladder, which rates 90.7-98.7% equal. Applying the same reconstruction to Graph attributes much of that difference to the scale rather than the corpus: its form based on the HTTP verb alone rates 92.0% of Google pairs and 89.0-92.0% of Graph pairs equal. Four risk measures (operations, writes, services reached, administrative surface) order 28.7% of incomparable Google pairs and 15.7-23.4% of Graph pairs in opposite directions, so for those pairs the ranking has no measure-independent answer. Offered pools of minimal and larger grants, 6 frontier models pick a minimal grant on 99.0% of 1,708 decisions, a grant smallest under all four measures on 66.7%, and on 22.1% a grant that another option matches or beats on every measure. We propose that benchmarks report which minimal grant an agent chose and that deployments show the alternatives to whoever approves the grant.