Agentic AI and Permission Inheritance Risks: Rethinking Access Control in Autonomous Systems
Suleiman S. Abba
*
University of the Cumberlands, 6178 College Station Drive, Williamsburg, KY 40769, United States of America.
Onyinye Agatha Obioha-Val
University of the Cumberlands, 104 Maple Drive, Williamsburg, KY 40769, United States of America.
Abiodun Oluwaseun Ariyo
University of the Cumberlands, 104 Maple Drive, Williamsburg, KY 40769, United States of America.
Olalekan Jamiu Okunleye
University of the Cumberlands, 104 Maple Drive, Williamsburg, KY 40769, United States of America.
Akinde Michael Ogunmolu
Texas A&M University, 700 University Blvd, Kingsville, TX 78363, United States.
*Author to whom correspondence should be addressed.
Abstract
This study examines how autonomous artificial intelligence agents inherit and exercise digital permissions within enterprise and cloud computing environments and evaluates the security implications of applying traditional access control frameworks to agent-driven systems. A quantitative analytical design was employed using three publicly available datasets: the Google Cloud Identity and Access Management policy dataset, the MITRE ATT&CK Enterprise dataset, and the AWS IAM Access Advisor dataset. Network centrality analysis, K-means clustering, and permission utilization ratio modeling were applied to examine permission inheritance structures, identify dominant cybersecurity risks, and assess the efficiency of RBAC and ABAC authorization models. The analysis indicates that autonomous agents possess substantially higher average permissions (63.7) than human users (11.8), while agent identities exhibit the highest network centrality (0.66). Additionally, credential propagation attacks produced the highest impact with an average data exposure of 68 GB. The findings support the need for agent-specific identity governance, dynamic permission scoping, and enhanced credential monitoring mechanisms.
Keywords: Agentic artificial intelligence, permission inheritance, identity and access management, cloud security governance, autonomous system authorization