Privilege abuse — ASI03 in the OWASP Top 10 for Agentic Applications 2026 — is an AI agent exercising permissions beyond what its current task legitimately requires, whether because an attacker steered it, because delegation multiplied its authority, or because nobody ever removed grants it stopped needing. The root enabler is architectural: most systems authorize a principal once, at session start or at provisioning, and then trust that decision for the lifetime of the credential. Agents break every assumption that model was built on.

The fix is continuous authorization: re-evaluating what the agent may do at each action, against current policy, current trust, and current context. This post explains why the point-in-time model fails for agents, what continuous authorization means concretely, and how to implement it without grinding your platform to a halt. It is one spoke of the complete OWASP Agentic AI Top 10 guide.

Why point-in-time authorization fails for agents

Point-in-time authorization — check the principal's permissions at login or token issuance, then honor them until expiry — works acceptably for humans because human sessions are short, human intent is stable within a session, and humans notice when something is off. Agents violate all three assumptions:

  • Agents run long and act fast. A workflow can execute for hours and issue thousands of actions. A permission that was appropriate at step 3 may be wildly inappropriate at step 3,000 — and at machine speed, the gap between "authorization became wrong" and "damage done" is milliseconds, not the minutes a human would take.
  • Agent intent is manipulable mid-run. A hijacked goal does not re-authenticate. It arrives inside an already-authorized session and inherits every permission that session was granted. Under point-in-time authorization, the attacker's window is the credential's full lifetime.
  • Agents delegate. An orchestrator that hands work to sub-agents multiplies its authority across principals. If delegation passes the parent's own credential — the common shortcut — every sub-agent (and every sub-agent compromise) carries the parent's full permission set.
  • Agent estates drift. Agents get provisioned for pilots, repurposed for production, connected to new tools. The accidental variant of ASI03 — privilege creep — needs no attacker at all: it is the gap between what an agent holds and what it currently needs, growing quietly until something exploits it.

What continuous authorization actually means

Continuous authorization is the policy that no action is performed on the strength of a past decision: each action is evaluated when it is attempted, against the current state of four inputs.

  1. Current policy. The permission model as it stands now — not as it stood when the token was minted. Revoking an agent's write access takes effect on its next action, not at token expiry.
  2. Current identity and trust. Is the credential still valid, and does the principal's trust standing still support this class of action? A trust score that degrades on anomalous behavior can gate sensitive actions dynamically — the pattern described in trust scoring for autonomous agents.
  3. Current task context. Is this action within the envelope of the task the agent is actually performing? An agent's authorization to read customer records for support ticket resolution is not authorization to bulk-export them mid-task.
  4. Current resource state. Budgets, rate limits, and concurrency caps evaluated at dispatch — reservation-based enforcement is continuous authorization applied to spend.

Architecturally, this requires the enforcement point to sit in infrastructure the agent's traffic must traverse — the control-plane chokepoint argued for in AI agent runtime security — because per-action decisions embedded in the agent's own process share the agent's fate when it is compromised.

Delegation: where privilege abuse compounds

Delegation deserves its own treatment because it is where ASI03 becomes a multi-agent problem. The safe pattern has three rules:

  • Sub-agents get scoped tokens, not parent credentials. The delegated credential is bounded by the specific subtask and expires with it. Revoking it ends one delegation chain, not the parent's operation.
  • Delegated authority is monotonically decreasing. No sub-agent can hold more permission than its delegator — and re-delegation narrows further. An agent cannot mint authority it does not have.
  • The chain is attributable. The audit record for a sub-agent's action names the full delegation path, so "which agent authorized this?" has an answer. This is the same per-principal identity discipline covered in how to authenticate AI agents, extended transitively.

Without these rules, a multi-agent system converges on a de facto shared super-credential — the worst possible ASI03 posture, where compromising the weakest agent yields the union of everyone's permissions. The communication-layer half of that problem is covered in securing inter-agent communication.

Containing the accidental variant: privilege creep

Attackers exploit over-privilege; entropy creates it. The controls against creep are lifecycle controls:

  • Short-lived, scoped credentials by default. Stale privilege should expire on its own; standing broad grants should be the exception that requires justification, not the default that requires cleanup.
  • Access reviews on a cadence, plus inactivity detection. Reviews that enumerate every agent's current permissions against its current function catch the pilot agent still holding production write access. Inactivity signals — an agent that has not used a permission in ninety days — are the cheapest creep detector available.
  • Ownership metadata. Every agent has a human owner accountable for its permission set; orphaned agents route to review automatically. An agent with no owner and broad permissions is ASI03 and ASI10 (rogue agent) exposure at once.
  • Provision from templates, not by copying. Cloning an existing agent's permissions to save time is how one over-broad grant becomes a fleet-wide pattern.

Implementation without paralysis

The standard objection to per-action authorization is overhead. In practice the cost is manageable with three techniques: evaluate cheap checks always and expensive checks proportionally (identity and scope on every action; deep contextual analysis on sensitive action classes); cache policy data with short TTLs and explicit invalidation on revocation, so the hot path is a local decision that still converges to current policy in seconds; and push enforcement to the existing chokepoint rather than adding a new hop — if agent traffic already flows through a gateway or control plane for guardrails and metering, authorization rides the same interception.

Milliseconds of policy evaluation against model calls measured in seconds is not the trade-off that should worry you; an hours-long credential window during a hijack is.

Common questions

What is agent privilege abuse (ASI03)? It is an AI agent exercising permissions beyond what its current task legitimately requires — through attacker manipulation, unsafe delegation, or accumulated stale grants. OWASP ranks it high because agents hold real credentials, and any compromise of agent behavior converts directly into use of those credentials.

What is continuous authorization in one sentence? Re-evaluating an agent's permission to act at every action, against current policy, current trust, and current task context — instead of trusting a check performed at session start or credential issuance.

Isn't this just zero trust for agents? It is the agentic application of the same principle: never trust a past decision, verify per request. What agents add is scale (thousands of actions per session), manipulability (goals rewritten mid-run), and delegation (authority multiplying across principals) — which turn per-request verification from best practice into the only model that holds.

Does continuous authorization stop goal hijacking? It does not prevent the hijack; it caps what the hijack can cash out. A rewritten goal that requires out-of-scope tools or data fails at the enforcement point regardless of how convincing the injected instructions were. Pair it with the detection and guardrail controls in the goal hijacking post for coverage of both halves.

Where do we start if everything is point-in-time today? Per-agent identity first — nothing can be scoped or revoked precisely while agents share credentials. Then move revocation to per-action effect (deny-lists or short TTLs with invalidation), then add task-context scoping on the most sensitive action classes. Each step is independently valuable; the sequence matches the identity and access guide.