AI Agent Access Control: Least-Privilege for Every Agent

What Is AI Agent Access Control?

AI agent access control is the set of policies that decide whether a given caller may reach a given resource. It answers "is this allowed," while guardrails answer "what is in it."

That distinction is worth holding onto, because the two controls fail in different ways and you need both.

• Access control is the bouncer at the door. It checks whether this agent, user, or team is permitted to call this model or this MCP tool at all.
• Guardrails are the metal detector. Once a call is allowed through, they inspect the prompt, the output, and the tool arguments for injections, PII, secrets, or unsafe operations.

An agent can be fully authorized to call your database MCP server and still be tricked into sending a destructive query. Access control said yes to the server, and only a guardrail on the arguments catches what the query actually does. Scope the access too broadly, though, and you are relying entirely on the metal detector. Least privilege is what keeps the number of allowed calls small in the first place.

The Two Levels of Access Control in TrueFoundry

TrueFoundry enforces access at two levels, and understanding the split is most of the work.

Resource-level roles (collaborators)

You add a user, team, or virtual account as a collaborator directly on a resource, and pick a role that scopes their access to that resource only. The roles are specific to the resource type:

This is where least privilege lives. Grant an agent Agent Access to only the MCP servers its job needs, make one team a User on the model account it is allowed to call, and add an MCP Server Approver when a tool should require sign-off before it runs. No custom role creation is needed for any of it.

Tenant-level roles

Tenant-level roles apply across the whole tenant and are configured under Access, then Roles. They govern tenant-wide actions such as creating resources, managing users, and listing every resource of a type. TrueFoundry ships with two: Admin, which is full control and should stay limited to a handful of people, and Member, which by default has access to nothing and must be granted resource access explicitly. When those two are too broad or too narrow, you create a custom role.

‍

Product screenshot, TrueFoundry docs: custom role permissions.

‍

Roles can attach to teams as well as individual users, and a user's effective permissions are the union of their own role and every role inherited from their teams. For organizations that sync identity groups over SCIM, those groups come in as TrueFoundry teams and can be granted roles directly, so access follows the same source of truth your IdP already manages.

How Access Control Works for MCP Tools

The MCP Gateway separates three concerns that teams usually tangle together, and keeping them apart is what makes tool-level least privilege practical.

‍