AI agent governance: why least privilege no longer solves the problem

Zenity reported that least privilege alone fails for agentic AI because agents can act outside their intended purpose while staying within their permission set. The report advocates for 'least agency,' decision budgets, and runtime scoping as the missing governance layer to constrain autonomous actions. Teams must define behavioral authorization rules and map runtime scoping to high-risk workflows to prevent unauthorized tool use.