Least Privilege Doesn't Survive an Agent Chain. Your Platform Is Where You Fix It
Platform Engineering, Monday, August 24th, 2026
Agent chains ratchet permissions upward because credentials lack built-in attenuation; platforms must enforce it.
As AI agents call tools and other agents in chains, an initial permission grant can persist or widen rather than narrow, creating what the author calls a scope ratchet.
Traditional OAuth standards do not require downstream tokens to be narrower than upstream ones, which enables privilege escalation. The proposed fix is capability tokens with cryptographic caveats that enforce attenuation structurally, at the cost of larger tokens, harder revocation, and key management overhead.
For simple fixed service graphs, scoped service accounts with mutual TLS remain preferable, but dynamic agent chains need stronger controls built into the platform.