# Least-Privilege AI Agents: Identity & Permissions in Harness

DevFeed: [Least-Privilege AI Agents: Identity & Permissions in Harness](<https://devfeed.tech/articles/least-privilege-ai-agents-identity-permissions-in-harness-13425.md>)

Original publisher: [Read original article](<https://www.harness.io/blog/identity-and-permissions-for-ai-worker-agents-in-harness>)

Author: Shivansh Srivastava Shubham Jindal

Published: 2026-07-16T00:00:00Z

Content type: article

Language: en

Sources: [Harness Blog](<https://devfeed.tech/sources/harness-blog.md>)

Topics: [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [least-privilege](<https://devfeed.tech/tags/least-privilege.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-gateway](<https://devfeed.tech/tags/mcp-gateway.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

Harness describes how its Autonomous Worker Agents use delegated identity, per-run ephemeral tokens, inherited RBAC and OPA policy, least-privilege scope filtering, and server-side MCP gateway tool intersection. The design gives agents a bounded subset of the triggering principal's permissions and removes token access when a run ends.

## Source excerpt

How Harness scopes AI Worker Agent access with delegated identity, ephemeral tokens, RBAC, OPA policy, and the MCP gateway tool, enforced server-side. | Blog