AI agents: audit access rights before expanding their work

Entrusting more work to an AI agent requires reviewing what its account can view, modify or transmit. On 16 September 2026, Anthropic announced the gradual merger of Cowork and chat: a single conversation can use more capabilities, with the existing connectors. For an executive committee, this development calls for a review of the rights attached to the relevant uses. Anthropic, 2026

From discussion to execution, a boundary to make visible

Continuity between discussion and execution makes delegation easier. It can also make the shift from a request for analysis to authorisation for an operation less visible to the user.

Anthropic states that Claude requests authorisation by default before acting and announces at least 30 days’ notice to Enterprise administrators before any change affecting their organisation. The announcement therefore does not mean that rights are immediately extended for everyone. It gives companies a reason to check what their configurations will allow at deployment. Anthropic, September 2026

Delegation is also advancing in internal work. According to its experimental index, Anthropic estimates that in August 2026 Claude handled most execution on 26% of its AI R&D work, under human supervision. This internal measure itself relies on models to assess tasks. It measures neither cost savings nor full autonomy. Anthropic, 2026

We recommend linking every expansion in work entrusted to an agent with a review of the necessary access and possible actions.

Connections determine the scope of a compromise

In an account published on 13 September 2026, Hacktron describes how two chained vulnerabilities allowed it, on 25 July, to compromise the ChatGPT and Codex accounts of OpenAI employees. The researchers report using a GitHub-connected Codex account to open a change proposal in an internal repository. Hacktron, 2026

This demonstration has a specific scope. The researchers distinguish the action performed from other potentially accessible connectors: their account does not allow the conclusion that they accessed messaging systems or extracted all available documents. They also state that OpenAI confirmed the fix on 25 July. The image-processing vulnerability used as the entry point is covered by a Discourse security advisory published on 28 July. Hacktron, 2026, Discourse, 2026

This case illustrates how a compromise can reach the systems connected to an account. It says nothing about the frequency of such incidents in European companies or their average cost. For management, however, it justifies examining the powers accessible through each connection.

Define rights based on the expected work

The review should bring together the business owner, IT and security around a specific process: preparing a response to a complaint, reconciling invoices or analysing a sales portfolio.

The business first describes the expected deliverable and identifies the person accountable for it. It then separates the necessary operations from those that commit the company. Viewing a file, finding a clause and preparing a letter do not automatically justify the right to send the response or authorise a refund.

IT documents, for each connection, the identity used, the accessible data and the permitted operations. This list must be compared with the business need, including when an account already has extensive rights.

The principle of least privilege applies to agents: OWASP recommends limiting their functions and permissions, and enforcing authorisations through the recipient systems. An instruction addressed to the model does not replace this technical restriction. OWASP, 2025 reference

Take a fictional example. A claims manager at an insurer wants to reduce the time spent gathering documents and drafting responses. The team is considering connecting the agent to an experienced handler’s account. The review reveals that this account also allows access to files unrelated to the assigned claims and the modification of certain customer data.

In this scenario, the team retains access limited to assigned files. The agent places a draft letter in a validation space; the handler checks the cited documents and decides whether to send it. Refunds remain subject to the existing authorisation process.

This validation must show what the person is authorising: the recipient, the data transmitted and the effect of the action. For an operation that is difficult to reverse, the control must take place before execution. Discovering a sensitive transmission in logs comes too late to prevent it.

Check that limits hold and that stopping works

A documented configuration must be tested. In a test environment, the team verifies that an out-of-scope attempt actually fails. It also tests access revocation and observes what happens to tasks already underway.

The business owner must know the suspension process. IT must be able to show where the interruption takes effect and what it stops. Security retains the exercise results and the gaps to correct.

These elements constitute the evidence of the review. They also make it possible to record why a right was granted, who is accountable for it and on what basis it may be retained. A new connection, a change of account or the addition of a sending function must trigger a new review.

Decide on expansion based on the cost of accepted work

In the claims example, the trial must establish whether the handler completes a correctly processed file faster, including verification and corrections. Fast drafting followed by laborious searching for supporting documents is not enough to demonstrate a gain.

The cost per accepted file must therefore include supervision, rework and operations. Generation time, taken in isolation, is not a measure of return on investment.

To decide whether to maintain, reduce or expand the scope, the executive committee can request a record that matches each indicator with its evidence:

| Indicator | Expected evidence | | --- | --- | | Rights without business justification | Review of permissions and withdrawal decisions | | Sensitive actions without compliant validation | Reconciliation of actions and approvals | | Effective stop time | Time-stamped revocation exercise | | Time and cost per accepted file | Measurement including control, corrections and operations | | Rework rate | Files returned to the handler, with reasons |

Choose an existing process and request its access record, a refusal test and its full cost per file. Expansion can then be decided based on justified rights and observed results.