🤖 AI

A Theory of Least Autonomy in AI

This paper proposes "least autonomy" as a necessary generalization of the least privilege principle for agentic AI systems, introducing a formal theory that combines compositional blast radius metrics, directed agent influence graphs, and collusion predicates to detect and control complex authorization compositions and cross-domain capability manipulations.

Original authors: Christophe Parisel

Published 2026-07-14

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Christophe Parisel

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive, high-tech office building where the security guards used to have a simple rule: "Don't give anyone a key to a room they don't need." This is called Least Privilege. For decades, this worked great for humans and simple robots. If a janitor needed to clean the bathroom, they got a bathroom key. If they didn't need the vault, they didn't get the vault key. Simple, right?

But now, we've built Agentic AI—smart, autonomous digital workers that don't just open doors; they can knock on other doors, ask other workers to open things, and combine their little keys to unlock giant, secret doors they never had access to on their own. The old "one key, one room" rule isn't enough anymore.

Enter Least Autonomy, a new theory proposed by researcher Christophe Parisel in a paper dated July 14, 2026. It's like upgrading the security system from checking "Who has the key?" to asking, "Who can team up to break the whole building down?"

The New Danger: The "Blast Radius"

The paper suggests that we need to measure something called the Compositional Blast Radius. Think of this as a "danger distance" meter.

Imagine the office building is a giant tree. The roots are the CEO, the branches are departments (like Finance or Engineering), and the leaves are specific files or tools. The paper uses a special math trick (an ultrametric tree) to measure how far apart two actions are on this tree.

If two actions happen in the same tiny room, the distance is zero.
If one action is in the "Finance" branch and the other is in "Engineering," the distance is bigger.
If they are in completely different buildings (like "Operations" vs. "Corporate"), the distance is huge.

But it's not just about distance. The paper adds a "sensitivity label" to every room. Some rooms are just "Standard" (low risk), while others are "High Integrity" (don't mess with the numbers) or "High Confidentiality" (don't let secrets leak). The theory combines the distance and the sensitivity labels to calculate a multiplier (ranging from 1.00 to 2.00).

So, the "Blast Radius" isn't just how far apart two actions are; it's how far apart they are weighted by how dangerous they are. If a low-risk action in Finance combines with a high-risk action in Engineering, the "blast radius" of that combination gets a big score.

The "Meeting" and the "Influence Graph"

Here is where it gets tricky. The paper argues that we can't just look at what an AI agent can do alone. We have to look at who they can talk to.

The authors introduce the idea of a Meeting.

Resource Meeting: Agent A writes a note on a whiteboard, and Agent B reads that same whiteboard. They "met" at the whiteboard.
Agent-to-Agent (A2A) Meeting: Agent A and Agent B have a direct chat channel. The paper is very conservative here: even if the chat looks one-way, the authors assume Agent B could somehow influence Agent A back (maybe by sending a tricky message or a tool output). So, they treat this as a two-way street.

Once we know who "met," we calculate an Influence Potential. This is a score of how much "structural span" their combined actions cover. If Agent A writes to a sensitive vault and Agent B reads a sensitive report, and they met, their influence potential is high.

Then, we draw a map called the Influence Graph. We only draw a line (an arc) between two agents if:

They had a "Meeting."
Their Influence Potential is above a certain Threshold ( $\theta$ ).

The paper is careful to say this threshold ( $\theta$ ) isn't a magic number found by a computer. It's a policy choice made by a human security boss, calibrated against a "catalogue" of all possible action combinations in the company.

The "Collusion" Trap

The scariest part of the theory is the Collusion Predicate. This is a test to see if a group of agents could team up to do something bad, even if no single agent is doing anything wrong on its own.

The paper identifies three ways agents can "collude" in this graph:

Authorization Composition: Agent A has the power to approve a request, and Agent B has the power to execute it. If A can influence B (or vice versa), they can bypass the rules.
Decision Manipulation: Agent A can influence Agent B, and Agent B has the power to approve something. A can trick B into approving a bad decision.
Cross-Domain Exposure: Agent A can reach into the "Finance" domain, and Agent B can reach into the "Engineering" domain. If they are connected in the graph, they might accidentally (or maliciously) mix these worlds in a way the rules said shouldn't happen.

What the Paper Rules Out (The "No-Go" Zones)

It is crucial to understand what this theory does not do.

It is NOT a runtime monitor. The paper explicitly states this is a static design-time analysis. It's like checking the blueprints of a building before you build it. It doesn't watch the agents in real-time to see if they are actually talking. It just says, "If the blueprints look like this, there is a risk."
It does not prove a crime happened. Finding a "collusion witness" in the graph doesn't mean the agents did anything wrong. It just means the configuration allows for it. It's a "red flag" for security engineers to go review the permissions.
It doesn't care about the "how" of the action. The paper admits that a "read" action and a "delete" action on the same file have the same "structural distance" (zero) in their math. The theory focuses on the structure of the permissions, not the specific type of operation (like whether it's a destructive delete or a harmless read).

The Verdict: A New Safety Net

The paper concludes that Least Privilege is still necessary, but it is insufficient for these smart, connected AI agents. You can give an agent the "least" permissions, but if that agent can talk to another agent who has different "least" permissions, they might combine to create a "greatest" permission that nobody intended.

The authors propose Least Autonomy as a complementary rule. It asks: "What is the maximum 'blast radius' of authority this agent could ever reach, even through a chain of friends?"

The paper provides a step-by-step guide for security engineers to build this model:

Map out the company tree and label the sensitivity of every node.
List all possible actions.
Set a threshold ( $\theta$ ) based on the company's risk tolerance.
Draw the influence graph.
Check for "collusion witnesses."

If the graph shows a collusion risk, the engineers must redesign the workflow, change the permissions, or lower the threshold. The paper suggests this is a way to catch "invisible" risks that standard permission checks miss, but it admits that the model relies heavily on the accuracy of the inputs (the tree, the labels, and the meeting definitions).

In short, the paper suggests that in a world of AI agents, we can't just check who holds the keys. We have to check who can knock on whose door and what happens when they combine their knocks. It's a new way to think about safety, one that treats the whole network of agents as a single, potentially dangerous organism that needs to be kept in check.

Technical Summary: A Theory of Least Autonomy in AI

1. Problem Statement

The principle of Least Privilege, established in the 1970s, dictates that an identity should hold only the permissions strictly necessary for its task. While effective for human users and static software processes, this paper argues that Least Privilege is insufficient for agentic AI systems.

Unlike passive actors, agentic systems possess dynamic capabilities: they can sequence actions, delegate tasks, transform outputs, and trigger workflows across system boundaries. Consequently, a configuration where individual permissions appear innocuous in isolation can create significant risk when combined. Two specific properties of agentic systems exacerbate this:

Gatekeeping: An agent may lack direct access to sensitive data but retain the authority to approve or enable another principal's access.
Composition: An agent's operational reach may depend not only on its own permissions but on the actions of other agents it can influence.

Current permission-by-permission reviews fail to capture the "authority exposure" arising from these multi-agent interactions, necessitating a shift from analyzing static permissions to analyzing autonomy.

2. Methodology and Formal Framework

The paper proposes a formal theory of Least Autonomy, structured across three layers: the Action layer, the Agent layer, and the System layer.

2.1 The Action Layer: Compositional Blast Radius

The framework models the enterprise information system as a rooted tree $T$ (an ultrametric hierarchy) where leaf nodes represent resources and internal nodes represent organizational scopes.

Sensitivity Lattice: Each node is assigned a local label $\ell(v) = (flow, axes)$ , where $flow \in \{\emptyset, GK, Ac\}$ (representing no flow, Gatekeeper, or Accessor) and $axes \subseteq \{C, I\}$ (Confidentiality, Integrity).
Path-Accumulated Labels: Labels are propagated up the tree using a join operator $\otimes$ , accumulating sensitivity along the path from the root to a resource.
Blast Radius ( $d(a, b)$ ): A pseudoultrametric distance is defined between two actions $a$ and $b$ . It combines the structural distance in the hierarchy (based on the Lowest Common Ancestor depth) with a multiplier derived from the sensitivity labels of the actions' resource nodes. This metric quantifies the "structural span" of a potential interaction.

2.2 The Agent Layer: Influence Graph

The theory lifts action-level metrics to the agent level using a Directed Agent Influence Graph $G(\theta)$ .

Meetings: An arc between agents $U$ $U$ and $V$ $V$ is predicated on a "meeting," defined as either:
1. A Directed Resource Meeting: $U$ can write to a resource that $V$ can read.
2. An Undirected A2A Meeting: $U$ and $V$ have a configured communication path (treated conservatively as bidirectional to account for reverse influence via prompts or artifacts).
Influence Potential ( $\Phi$ ): For a meeting to generate an arc, the maximum blast radius between the relevant action sets (e.g., $U$ 's writes and $V$ 's reads) must meet or exceed a policy threshold $\theta$ .
Effective Autonomy: Defined as the set of all actions assigned to an agent plus the actions of any agent reachable via directed paths in $G(\theta)$ . This represents a conservative abstraction of capability exposure.

2.3 The System Layer: Collusion Predicate

The framework defines a Collusion Predicate to detect harmful multi-agent compositions. A set of agents $S$ is flagged as colluding if distinct agents $U, V \in S$ satisfy directed reachability in $G(\theta)$ AND meet one of three conditions:

Authorization Composition: $U$ has gatekeeping authority over a resource $V$ accesses ($Gates(U, V)$).
Decision Manipulation: $V$ has gatekeeping authority over a resource $U$ accesses ($Gates(V, U)$).
Cross-Domain Exposure: $U$ and $V$ can influence agents that hold capabilities in separated security domains (e.g., Finance vs. Engineering).

3. Key Contributions

The paper makes three primary contributions:

Compositional Blast Radius: A formal metric combining an ultrametric enterprise hierarchy with a lattice-valued sensitivity structure to measure structural separation between actions.
Directed Influence Graph & Collusion Predicate: A graph-based model where arcs are conditioned on resource or communication meetings and a policy threshold $\theta$ . This includes a mechanism to detect authorization composition, decision manipulation, and cross-domain capability composition.
Design Procedure: A step-by-step methodology for security engineers to translate the model into practice, including the calibration of the threshold $\theta$ and an individual autonomy budget $\tau_{aut}$ .

4. Results and Illustrative Example

The paper provides a step-by-step design procedure and an illustrative example involving an enterprise hierarchy with Finance, Engineering, Compliance, and Legal domains.

Calibration: The example demonstrates how to select $\theta$ based on a "catalogue-radius profile" (the distribution of blast radii in the system) to distinguish between low-impact and high-impact interactions.
Detection Scenarios: The example successfully identifies:
- Individual Budget Breaches: Agents whose direct or effective autonomy exceeds the allowed blast radius ( $\tau_{aut}$ ).
- Collusion: Pairs of agents where directed influence combined with gatekeeping roles creates a risk (e.g., an agent influencing a gatekeeper who then authorizes access to a resource the first agent can read).
Differentiation: The example distinguishes between "material influence" (meeting the threshold but not colluding) and "collusion-positive" configurations, showing how the framework isolates specific risk vectors.

5. Significance and Claims

The paper positions Least Autonomy not as a replacement for Least Privilege, but as a complementary design criterion.

Static Analysis: The framework is a static, design-time analysis tool. It identifies configurations that warrant review but does not claim to prove provenance, command authority, or realized execution traces.
Conservative Abstraction: The model is intentionally conservative. It treats potential influence paths as worst-case capability exposures. A positive result indicates a configuration that requires policy review, runtime mediation, or redesign, rather than confirming an active attack.
Scope: The theory addresses the specific challenge of how permissions distributed across multiple agents may combine across organizational scopes and security domains, a gap not covered by traditional Role-Based Access Control (RBAC) or runtime tool authorization systems.

The paper concludes that while Least Privilege remains necessary, it cannot characterize the authority exposure inherent in agentic AI systems. The proposed theory provides a structured method to identify and audit these high-impact, multi-agent interactions.