A Theory of Least Autonomy in AI
06:00 · July 14, 2026 · arXiv cs.AI RSS
Least privilege, the principle that an identity should hold only the permissions strictly required for its task, has been a foundational primitive of access control for decades. We argue that this principle is insufficient for agentic AI systems, which do not merely hold permissions but can combine, approve, and amplify them across workflows and system boundaries. We propose least autonomy as an appropriate generalization and develop a formal theory. First, we define a compositional blast radius d(a,b) that measures structural separation between actions in an enterprise hierarchy, combining an ultrametric tree with lattice-valued confidentiality, integrity, and control-context labels. Second, we define a directed agent influence graph G(theta). An arc from U to V requires a directed shared-resource write-to-read meeting or a conservative undirected agent-to-agent (A2A) communication meeting, and a meeting-conditioned influence potential at or above an externally selected policy threshold theta. A catalogue-radius profile supports calibration and audit of theta. Finally, we define a collusion predicate over graph reachability that detects authorization composition, decision manipulation, and cross-domain capability composition.
Summary
The article argues that the classical principle of least privilege, which limits each identity to the permissions strictly required for its task, falls short for agentic AI systems. These systems do not merely exercise permissions in isolation; they can sequence actions, delegate tasks, approve privilege elevations, and compose capabilities across organizational boundaries and workflows. Gatekeeping authority and cross-agent composition introduce risks that permission-by-permission reviews do not capture, because innocuous individual rights may combine into unauthorized reach when one agent can influence another.
To address this gap, the paper introduces least autonomy as a complementary design criterion. Rather than asking only what an identity can access, least autonomy asks what authority exposure arises when an agent’s permissions interact with those of agents it can reach through resource-mediated or communication-mediated meetings. The framework models the enterprise as a rooted ultrametric tree whose nodes represent resources and organizational scopes. From this tree it derives a compositional blast radius that quantifies structural separation between actions, combining tree distance with lattice-valued labels for confidentiality, integrity, and control context.
A directed agent influence graph is then constructed over this metric. An arc exists between agents when a qualifying meeting occurs—either a directed write-to-read on a shared resource or a conservatively treated undirected agent-to-agent communication channel—and the meeting-conditioned influence potential meets or exceeds a policy threshold. Reachability in the resulting graph supplies a collusion predicate that identifies authorization composition, decision manipulation, and cross-domain capability assembly. The model includes an auditable catalogue-radius profile for calibrating the threshold and supports both static analysis and comparison against traditional least-privilege practice.
The paper concludes with a step-by-step design procedure that translates the formal elements into concrete guidance for evaluating enterprise AI security configurations, illustrated on a representative hierarchy.
Why it matters
This theoretical framework directly supports the Dutch and EU focus on secure, ethical, and transparent AI by providing rigorous methods to audit and constrain autonomous AI agents. It offers advanced researchers actionable mathematical models to prevent dangerous capability composition in enterprise AI deployments.
