Minimum viable permissions
for AI agent task classes.
Mode is investigating whether task-type classification can automatically derive minimum permission sets for AI agents operating across a multi-dimensional permission system, and whether least-privilege enforcement reduces constraint violations without degrading task completion rates beyond acceptable thresholds.
The research question
Can task-type classification be used to automatically derive minimum permission sets for AI agents operating across a multi-dimensional permission system, and does least-privilege enforcement reduce constraint violations without degrading task completion rates beyond acceptable thresholds?
Least-privilege is a foundational principle in systems security: grant only the permissions a process actually needs, nothing more. Applied to AI agents, it means agents should operate with the smallest permission footprint that still allows the task to complete. Mode is investigating whether this principle can be automated, using task-type classification to infer minimum permissions before execution, and whether that automation produces measurable safety improvements in multi-agent workflows.
Why existing approaches fall short
AI agents today are routinely over-provisioned. The tools to fix this are nascent and don't address the multi-dimensional case.
Agents are routinely over-provisioned to avoid permission errors
In practice, agents are granted broad permissions before execution to ensure tasks complete without permission-related failures. This is analogous to giving every application administrator access to simplify deployment. Research on agentic authorization found that probabilistic authorization produced a significant reduction in unnecessary permissions compared to standard provisioning approaches, meaning current permission grants are significantly over-broad. Over-provisioned agents expand the attack surface for prompt injection and privilege escalation. If an injected instruction can execute, broad permissions determine how much damage it can cause.
Manual permission configuration precedes task knowledge
Existing agent permission systems require administrators to configure permissions before execution, without complete knowledge of what the task will actually require at each step. This creates a forced choice between over-provisioning (risky) and under-provisioning (task-blocking). Neither produces optimal outcomes. The solution is to infer minimum permissions from task type before execution and verify against actual usage after, producing a learning system that improves permission recommendations over time.
Automated permission inference addresses only single-dimensional systems
Research on automating data access permissions achieved 85.1% accuracy overall and 94.4% for high-confidence predictions, demonstrating that permission inference from task context is technically feasible. MiniScope provides a least-privilege framework for tool authorization for individual agents. Both address single-dimensional permission problems, data access or tool selection, not multi-dimensional systems governing scope, operations, agent delegation, and duration simultaneously. The multi-dimensional case introduces interactions between permission dimensions that single-dimension inference cannot capture.
Mode's approach
Mode Agent's four-dimensional permission system and multi-agent orchestration layer generate the permission usage data needed to study minimum viable permissions empirically.
Permission usage traces per task
Every task execution through the Agent's orchestration layer produces a complete record of which permissions were granted, which were exercised, and which were never used. This permission trace data, across task types, agent types, and provider combinations, is the foundation for minimum viable permission inference.
Four-dimensional permission coverage
The Agent's permission system covers scope (what the agent can access), operations (what it can do), agents (what it can invoke), and duration (how long it can operate). Studying minimum viable permissions across all four dimensions simultaneously is only possible with a system that enforces all four, which is what the Agent does.
Task-type classification
The Agent routes tasks to specialized agents by task type. This classification infrastructure can be extended to permission inference: if task type predicts the permission set needed, classification before execution enables least-privilege provisioning before the task begins.
Controlled tradeoff measurement
The Agent can run identical tasks under full permissions and minimum viable permissions and directly measure the difference in task completion rate, violation rate, and false positive blocks. The tradeoff between permission tightness and task success is a first-class experimental parameter.
The gap in existing research
Least-privilege is foundational in systems security with decades of OS and network literature. Its application to multi-dimensional AI agent permission systems, governing access scope, operation types, agent delegation, and execution duration simultaneously, has not been empirically studied.
Existing AI permission work addresses single-dimensional authorization: data access or tool selection, for individual agents. No published work studies multi-dimensional permission minimization across a multi-agent orchestration layer, or measures the violation-rate reduction and task-completion tradeoff that least-privilege enforcement produces in this setting. Mode Agent's four-dimensional system and orchestration infrastructure make this the right environment to fill that gap.
What we are measuring
Our evaluation framework compares minimum viable permission configurations against full permission configurations for identical task sets across all four permission dimensions.
Primary metrics, directly answer the research question.
Permission utilization rate
What percentage of granted permissions are actually exercised per task class. The gap between granted and used permissions is the over-provisioning measure, and the attack surface that least-privilege eliminates.
Task completion under MVP
What percentage of tasks complete successfully under minimum viable permissions vs. full permissions. Measures whether least-privilege provisioning produces task failures at an unacceptable rate.
Violation rate reduction
How much constraint violation rate decreases under minimum viable permissions vs. full permissions, measuring the safety improvement produced by least-privilege enforcement.
Secondary metrics, characterize the inference system and operational tradeoffs.
Permission inference accuracy
How accurately task-type classification predicts the minimum permission set needed, measured against actual usage traces for the same task type.
False positive block rate
What percentage of legitimate, user-intended task steps are incorrectly blocked by minimum viable permission configurations, indicating under-inference.
Cross-dimension interactions
How often minimizing one permission dimension (e.g. scope) affects the minimum required configuration in another dimension (e.g. operations), characterizing the multi-dimensional constraint structure.
Related work
The research below establishes the over-provisioning problem, demonstrates the feasibility of permission inference, and defines the multi-dimensional gap this work fills.
Toward Agentic IAM: A Probabilistic Authorization Framework for Least Privilege AI Workflows
Introduces a probabilistic authorization framework for AI agent workflows. Formal verification confirmed resilience against agentic vulnerabilities. Empirical evaluation demonstrated sub-second latency and a significant reduction in unnecessary permissions compared to standard provisioning. Establishes that least-privilege automation is feasible and produces measurable safety improvements in single-agent settings.
IEEE/ACM BDCAT 2025Towards Automating Data Access Permissions in AI Agents
Argues that permission-based access control is indispensable for meaningful user control of AI agents. Develops a permission prediction model achieving 85.1% accuracy overall and 94.4% for high-confidence predictions in a data access context. Demonstrates that task-context-based permission inference is achievable but addresses only single-dimensional data access permissions.
arxiv.org/abs/2511.17959. November 2025MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents
Proposes a least-privilege framework specifically for tool authorization in LLM agents. Addresses the single-dimensional case of which tools an agent should be permitted to call, demonstrating that constrained tool access reduces the attack surface for prompt injection without eliminating task utility.
arxiv.org/abs/2512.11147. December 2025AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents
Demonstrates that runtime constraint enforcement achieves over 90% prevention of unsafe executions in code agent settings. Establishes the enforcement mechanism that least-privilege permission configurations would operate through, showing that enforcement itself works, and motivating the question of how to configure it optimally.
arxiv.org/abs/2503.18666. March 2025