# Your AI agent shouldn't inherit your admin's permissions

DevFeed: [Your AI agent shouldn't inherit your admin's permissions](<https://devfeed.tech/articles/your-ai-agent-shouldn-t-inherit-your-admin-s-permissions-16058.md>)

Original publisher: [Read original article](<https://workos.com/blog/scoping-ai-agent-permissions>)

Author: WorkOS

Published: 2026-09-03T00:00:00Z

Content type: release

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Authorization](<https://devfeed.tech/topics/authorization.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [audit](<https://devfeed.tech/tags/audit.md>), [auth](<https://devfeed.tech/tags/auth.md>), [permission](<https://devfeed.tech/tags/permission.md>)

## AI overview

The article explains how WorkOS Agent Auth limits delegated AI agent sessions using both the invoking user's permissions and an agent definition's permission ceiling. It describes delegated and autonomous agents, along with reusable definitions, allowed invokers, and session lifetimes.

## Source excerpt

Delegated agent sessions are now capped by the user and the agent definition at once, which closes a gap we couldn't close a few months ago.