Identity & Privilege Abuse: When Your Agent Acts Like It Owns the Place (ASI03)

Wed, 15 Jul 2026 07:10:00 +0300

This is post #3 of the OWASP Agentic AI Top 10: What Builders on AWS Need to Know series.

Your engineering manager builds an agent to help her team. She gives it access to the team’s Jira board, their code repos, and the internal wiki. Normal stuff.

Then the agent delegates a subtask to a “helper” agent. And that helper inherits all of the manager’s permissions. The full repo access. The HR data she can see. The production deployment keys cached in the session.

Cedar on Technodrone

Identity & Privilege Abuse: When Your Agent Acts Like It Owns the Place (ASI03)