List what the agent can reach
Record repositories, folders, cloud apps, MCP servers, tools, networks, and secrets available to the agent.
Fifteen-minute permission audit
Audit what your AI agent can reach.
List the files, tools, secrets, networks, and actions available to the agent. Remove unnecessary access, require approval for high-impact actions, and compare the list again whenever the setup changes.
This workflow is vendor-neutral. It helps expose permission gaps that are easy to miss when a model, plugin, MCP server, connector, or automation changes.
The complete workflow
Five decisions. One approved baseline.
Mark what it can change
Separate read access from write, delete, deploy, payment, identity, and external-send access.
Remove what it does not need
Reduce broad access, deny unused tools, narrow network destinations, and keep credentials outside agent context.
Require approval for high impact
Place human approval before deployment, deletion, payment, permission changes, or sending sensitive data.
Compare again after every change
Save the approved baseline and review permission drift when a model, tool, plugin, workflow, or connector changes.
Blank access register
Record access in one place.
Use one row per resource or action. The register is intentionally blank: it contains no customer records, vendor scores, or inferred permissions.
| Record | Question | Decision |
|---|---|---|
| Resource | What can the agent read, change, delete, send, or invoke? | Keep only what it needs |
| Credential | Where does access come from, and how broad is the token? | Use the narrowest scope |
| Network | Which external destinations can receive data? | Allow only required endpoints |
| Approval | Could the action deploy, delete, pay, or expose data? | Require a human first |
| Review | Did a tool, model, connector, plugin, or workflow change? | Compare with the baseline |
Vendor controls to inspect
Use the controls the provider actually documents.
GitHub Copilot coding agent
Review repository enablement and firewall allowlists; GitHub warns that broad destinations can increase exfiltration risk and that the firewall is not a complete security boundary.
Read official sourceGitHub Copilot CLI
Review allowed and denied tools, and avoid broad allow flags unless the environment supplies an independent boundary.
Read official sourceClaude Code
Review allowed tools, denied tools, permission mode, and whether permission bypass is enabled.
Read official sourceCursor CLI
Review project and global rules for file reads, file writes, shell commands, and network access.
Read official sourceCross-tool baseline
Use least privilege, explicit approval, isolated credentials, and repeat the review when access changes.
Read official sourceSources checked August 2, 2026. Documentation changes; verify the current provider settings before use.
Review triggers
Do not wait for a calendar reminder.
Review the register whenever the agent gains a new way to read, write, execute, connect, or act. A periodic review can catch forgotten access; a change-triggered review catches access before it becomes normal.
A tool, plugin, MCP server, connector, or workflow is added
Record the new capability, data path, credential, and external destination before it receives production access.
A model, permission mode, firewall rule, or allowlist changes
Compare the new scope with the approved baseline and require an owner decision for every added privilege.
A token, service account, repository, folder, or cloud app is connected
Confirm the narrowest available scope, expiry, revocation path, and who is accountable for the connection.
The agent can deploy, delete, spend, publish, invite, or send externally
Place a human approval step before the action and test that the agent cannot bypass it.
An agent behaves unexpectedly or a security signal appears
Pause added access, preserve privacy-reduced evidence, and review the authority available to the affected run.
Evidence, not memory
Save the approved state. Compare the next one.
A checklist captures one moment. Permission drift appears between moments. Store a dated baseline, rerun the review after a change, and require a reason for each added privilege or removed control.
Treat missing or unreadable configuration as unknown evidence, not proof of safety.
Separate a documented permission from proof that the control worked at runtime.
Do not place real secrets, customer data, or private paths in public evidence.
A completed audit reduces uncertainty; it does not guarantee protection.
When access should end
Turn the permission register into a complete offboarding record.
Follow the five-step closure workflow for identities, sessions, repositories, tokens, connectors, shared secrets, and residual access.
If an agent may already have taken an unsafe action, start with the AI-agent incident response checklist.
From register to evidence
Use CapitalGuard when a manual register is not enough.
CapitalGuard licenses add repository evidence, permission-drift analysis, prioritized findings, and the prevention assets included with the selected package.