--- title: "AI Agent Least Privilege: Step-by-Step Guide | OpenVPN" description: Give each AI agent its own identity, limit it to the applications its job needs, and cut it off in one click. A step-by-step CloudConnexa setup guide. image: https://blog.openvpn.net/hubfs/aa4093db-af7b-42db-9681-ef3f670e8812.png --- - [Blog](https://blog.openvpn.net) - [Cybersecurity](https://blog.openvpn.net/tag/cybersecurity) # How to Give AI Agents Least-Privilege Access: A Step-by-Step Guide Oct 28, 2026 • 10 min read ![a small robot looking at a checklist on a blue background OpenVPN ](https://blog.openvpn.net/hubfs/aa4093db-af7b-42db-9681-ef3f670e8812.png) Share - - - - AI Agent Least Privilege: Step-by-Step Guide | OpenVPN 11:33 By Rohit Kalbag ## **To give an AI agent least-privilege access, give it its own identity, grant that identity access to only the applications its job requires, and make sure you can revoke that access instantly.** In [CloudConnexa](https://openvpn.net/cloud-vpn/), each agent's container or VM gets its own device, authenticated by the device certificate in its OpenVPN connection profile. The agent can reach only the applications its group is authorized for, and you can cut it off without touching the agent's code. This guide walks through the setup step by step, from a dedicated agent environment to testing a simulated prompt injection. ## Why AI agents need least-privilege access AI agents act on their own: they read data, call APIs, and take actions. If an agent is manipulated or misconfigured, it'll use whatever access it has. Least privilege limits that damage, the "blast radius," to only what the agent was authorized to reach. OWASP calls the underlying weakness [excessive agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/): an agent with more permissions than its task needs. The most common way agents get manipulated is [prompt injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/): instructions hidden in content the agent processes, such as an email, document, or support ticket. Least privilege doesn't stop an agent from being tricked, but a tricked agent can't reach anything beyond its job. (Our guest contributor makes [the full case for agent identities](https://blog.openvpn.net/your-ai-agent-should-get-less-network-access-than-your-intern), if you want the deeper argument.) *Learn more about securing autonomous agents in our recent 2026 OpenVPN \[Con\]nected session [here](https://go.openvpn.net/connected-2026-replays).* ## What is a non-human identity? A non-human identity is an identity that belongs to software, such as an AI agent, service, or script, rather than a person. Like a user account, it can be authenticated, granted access, logged, and revoked, but it doesn't sign in with a password or a phone prompt. Without one, an agent borrows someone else's credentials, which makes it hard to limit or cut off on its own. Standards bodies are working on this too: [NIST's National Cybersecurity Center of Excellence](https://www.nccoe.nist.gov/projects/software-and-ai-agent-identity-and-authorization) has a project on software and AI agent identity and authorization. [![openvpn\_ztna-research-report\_email\_800x200](https://blog.openvpn.net/hs-fs/hubfs/openvpn_ztna-research-report_email_800x200.png?width=2500&height=625&name=openvpn_ztna-research-report_email_800x200.png)](https://go.openvpn.net/ztna-research-report-2026) ## Two ways AI agents connect to CloudConnexa - AI tools used by a person, such as an AI assistant on a laptop. The person signs in with SAML, LDAP, or a username and password, and the AI tool can reach only what that person is authorized to reach. - Autonomous agents running unattended in a container or VM. Nobody is there to enter credentials, so the connection is authenticated by the device certificate in the OpenVPN connection profile alone, with [Connect Auth](https://openvpn.net/cloud-docs/owner/settings/settings---users/set-the-default-connection-authentication--connect-auth--policy-for-users/) set so the agent is never prompted. The rest of this guide covers the second pattern. ## How to map AI agents to CloudConnexa groups, users, and devices For autonomous agents, CloudConnexa's building blocks map like this: - User group = the agent role and its access policy, for example all CRM sync agents. - User = the host or data center where the agents run. - Device = an individual agent's container or VM, with its own device certificate and connection profile. Because every container or VM gets its own [device](https://openvpn.net/cloud-docs/owner/users/users---devices/about-devices/), each agent has its own identity, even when several agents run on the same host. ## How CloudConnexa limits what an agent can reach CloudConnexa publishes internal systems as Applications and controls who can reach them with Access Groups. With [Application domain-based routing](https://openvpn.net/cloud-docs/owner/networks/networks---applications/about-application-domain-based-routing/), CloudConnexa answers the agent's DNS lookup with an intermediary IP address instead of the real server address, then forwards permitted traffic to the actual destination. The agent never gets a route into the network behind the application. Under a Custom topology, Access Groups deny by default, so an agent can reach the applications you've authorized, such as a CRM API, and has no route to anything else, such as a finance database. (For more on how this differs from full network access, see [network access vs. app-only access](https://blog.openvpn.net/identity-aware-proxy-vs-full-network).) ## How to set up least-privilege access for AI agents: step by step ### Before you start: create a dedicated WPC for AI agents CloudConnexa lets you run [multiple independent WPCs](https://openvpn.net/cloud-vpn/features/multiple-wpc/) (Wide-area Private Clouds) from the same account. A separate WPC isolates agent settings and traffic from human users. 1. **Create the WPC.** As the account Owner, open the Cloud ID drop-down and click Add Cloud ID (or go to Billing \> Subscription \> Add Subscription). Give it a clear Cloud ID, for example yourcompany-agents. Each WPC has its own subscription. 2. Turn on Access Groups. In the new WPC, set the WPC topology to Custom, then delete or edit the Default Full Mesh Access Group. Until you do, it keeps every connected resource reachable. See [Access Groups](https://openvpn.net/cloud-docs/owner/access/access---groups/about-access-groups/). 3. Set Profile Distribution to Manual. In Settings \> Users, click Edit and set [Profile Distribution](https://openvpn.net/cloud-docs/owner/settings/settings---users/set-the-profile-distribution-mode-for-users/) to Manual, so you can create devices and generate their profiles yourself. Employees in your main WPC aren't affected. 4. Make the resources agents need available. If the systems your agents use are already published as Applications in your main WPC, use [AppHub](https://openvpn.net/cloud-vpn/features/app-hub/) to share them with the agent WPC instead of deploying duplicate Connectors ([AppHub docs](https://openvpn.net/cloud-docs/owner/apphub/about-apphub/)). For systems that aren't connected yet, add Connectors and Applications in the agent WPC. ### Step 1: Create a user group for the agent role In Users \> Groups, [create a user group](https://openvpn.net/cloud-docs/owner/users/users---groups/add-a-user-group/) for the agent role, for example AI Agents - CRM Sync, and set Connect Auth to No. The agent is never prompted for credentials; every connection is authenticated by the certificate in its connection profile. ### Step 2: Add a user for each host or data center Add a user to the agent user group, named after the host or data center where the agents run, for example agent-host-east-01. ### Step 3: Create a device for each agent In Users \> Devices, [add a device](https://openvpn.net/cloud-docs/owner/users/users---devices/add-a-device-for-a-user/) for that user, named after the agent's container or VM, for example crm-sync-agent-01. Create one device per container or VM, so each agent has its own identity, its own entry in your logs, and its own off switch. ### Step 4: Download the profile and use it in the container or VM From the device's row, [download its connection profile](https://openvpn.net/cloud-docs/owner/users/users---devices/download-connection-profile-as-a--ovpn-file-for-a-user-s-device/) (.ovpn file), provide it to the container or VM, and connect with an OpenVPN client such as the [OpenVPN 3 Linux client](https://openvpn.net/community-docs/openvpn-client-for-linux/). The client opens an outbound tunnel to CloudConnexa, so no inbound ports are needed. Treat the profile as a secret, since it holds the agent's identity. Store it in your secrets manager and mount it at runtime rather than building it into the container image. Prefer to manage the agent's server as a host instead? CloudConnexa's [Host Connector](https://openvpn.net/cloud-docs/owner/hosts/hosts---connectors/about-host-connectors/) is another option, and a Host can also be an Access Group source. ### Step 5: Create an Access Group for the agent user group Create an Access Group with the agent user group as the source, and add only the Applications the agents need as destinations, for example the CRM API and internal knowledge base. Everything else stays unreachable. ### Step 6: Test allowed and denied access Confirm the agent's normal task works. Then simulate a prompt injection that asks it to reach an unauthorized system, such as a finance database. The attempt fails because the agent has no route there. ### Step 7: Know how to cut an agent off If an agent misbehaves, [delete or revoke its device](https://openvpn.net/cloud-docs/owner/users/users---devices/list-filter-search-edit-revoke-and-delete-devices/) in CloudConnexa. Deleting the device revokes its certificate and disconnects it, while other agents, even on the same host, keep working. To rotate an agent's identity instead, use Revoke Profile Certificate, which revokes the old certificate and generates a new profile. Use [Access Visibility](https://openvpn.net/cloud-vpn/features/access-visibility/) to review which resources the device accessed and which attempts were blocked. ## Applying least privilege to multi-agent systems When agents work together, give each agent role its own user group and Access Group. An orchestrator's group can reach the specialist agents' APIs, while each specialist's group reaches only the systems its job requires. A compromised research agent then can't reach the billing system or the billing agent. This controls which destinations each agent can reach; it doesn't inspect the messages agents send each other. ## What this approach does and doesn't cover CloudConnexa controls which applications each agent can reach, enforced by its identity. It doesn't inspect prompts, read agent-to-agent messages, or catalog the agents in your environment. Combine it with tight scoping of each agent's own API keys and permissions inside the applications it uses. ## AI agent least-privilege checklist - AI agents run in a dedicated WPC, with existing Applications shared through AppHub - The Default Full Mesh Access Group has been removed or edited in the agent WPC - Each agent role has its own user group with Connect Auth set to No - Each container or VM has its own device and connection profile - Profiles are stored as secrets, not built into images - Each agent user group has an Access Group granting only what it needs - Denied access has been tested with a simulated prompt injection - The team knows how to delete or revoke an agent's device immediately   ### Ready to see how OpenVPN can help protect your people and AI agents? Try the self-hosted Access Server solution or the managed CloudConnexa service for free, no credit card required. [See Which One is Right for You](https://openvpn.net/product-comparison/?_gl=1*1hi46u*_ga*NDgyODEwNDkyLjE3NzIxMjIzNDE.*_ga_E45Z33NTV7*czE3Nzc5ODY2ODIkbzExMiRnMSR0MTc3Nzk4ODMyMSRqNTUkbDAkaDE4NzIyNTczNDc.*_fplc*dVltNzJ6YmZ0bFZTdld4NjRtWVpVWXclMkJEV3AzZGhPUlRZaUppdWNxQkRjOER3MFN0VW84JTJCdEJGdnRDTmVYNlI5NlJBdTRLZ0VGOTNHMHc0U3l3bVFsR3NzQXk5RzJIQVdzNHE0QVJHcSUyQlVKUlRsNTM0S1RWZERyZ0V4NDNnJTNEJTNE*_gcl_au*MTM5NjEwNTIxNy4xNzcyMTIyMzQx*_ga_SPGM8Y8Y79*czE3Nzc5ODY2ODEkbzExMyRnMSR0MTc3Nzk4ODMyMyRqNTMkbDAkaDA.) ## Frequently asked questions ### What is least privilege for AI agents? Least privilege for AI agents means giving each agent access to only the specific applications and data its job requires. If the agent is manipulated or misconfigured, the damage is limited to that narrow scope. ### Should AI agents have their own identity? Yes. An agent that borrows a person's credentials gets everything that person can reach, and you can't limit or revoke the agent without affecting the person. Its own identity lets you scope, log, and cut off the agent on its own. ### What is a non-human identity? A non-human identity is an identity that belongs to software, such as an AI agent or service, rather than a person. In CloudConnexa, an unattended agent's identity is the device created for its container or VM, authenticated by the certificate in its OpenVPN connection profile. ### How does an unattended AI agent authenticate to CloudConnexa? Put the agent in a user group with Connect Auth set to No. The agent's container or VM connects with its own OpenVPN connection profile and is authenticated by the certificate in that profile, with no credential prompt. ### Does least privilege stop prompt injection? No. Least privilege doesn't stop an agent from being tricked, but it limits what a tricked agent can reach. If an injected instruction points the agent at a system outside its Access Group, the connection fails. ### Should AI agents have their own WPC? It's a good practice. CloudConnexa supports multiple independent WPCs in the same account. A dedicated agent WPC isolates agent traffic and settings from human users, and AppHub can share existing Applications with it so you don't need duplicate Connectors. ### Can multiple AI agents on the same host have separate identities? Yes. Create a separate device, with its own OpenVPN connection profile, for each agent's container or VM. Each agent then has its own identity and can be removed individually. ## Start securing your AI agents Give every agent its own identity and only the access it needs. [Start CloudConnexa Free](https://openvpn.net/pricing/)   ## Related reading - [Secure resource sharing with CloudConnexa AppHub](https://blog.openvpn.net/secure-resource-sharing-with-cloudconnexa-apphub) - [Least privilege by domain, not by subnet (Access Server)](https://blog.openvpn.net/least-privilege-by-domain-not-subnet) - [Introducing MCP Gateway](https://blog.openvpn.net/introducing-mcp-gateway-one-front-door-for-every-ai-agent-your-business-runs) - [How to Secure MCP Servers Without Exposing Them to the Internet](https://blog.openvpn.net/mcp-server-security) ## Related posts from OpenVPN ### [![Agentic AI Security: A Practical Guide for SMB and Mid-Market IT Teams](https://blog.openvpn.net/hubfs/8fb1fa10-bd2d-4d51-a71e-e640a2c76edb.png) Cybersecurity Oct 26, 2026 Agentic AI Security: A Practical Guide for SMB and Mid-Market IT Teams](https://blog.openvpn.net/agentic-ai-security) ### [![How CloudConnexa Delivers the SASE Framework](https://blog.openvpn.net/hubfs/cloudconnexa-blog-header-blue.png) Zero Trust Sep 21, 2026 How CloudConnexa Delivers the SASE Framework](https://blog.openvpn.net/how-cloudconnexa-delivers-sase-networking) ### [![How CloudConnexa Delivers the SSE Framework](https://blog.openvpn.net/hubfs/cloudconnexa-blog-header-blue.png) CloudConnexa Sep 8, 2026 How CloudConnexa Delivers the SSE Framework](https://blog.openvpn.net/how-cloudconnexa-delivers-sse) ### Subscribe for Blog Updates ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Rohit Kalbag", "url" : "https://blog.openvpn.net/author/rohit-kalbag" }, "dateModified" : "2026-10-28T15:08:19.310Z", "datePublished" : "2026-10-28T15:08:19.000Z", "headline" : "AI Agent Least Privilege: Step-by-Step Guide | OpenVPN", "image" : [ "https://blog.openvpn.net/hubfs/aa4093db-af7b-42db-9681-ef3f670e8812.png" ], "mainEntityOfPage" : { "@id" : "https://blog.openvpn.net/ai-agent-least-privilege", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.openvpn.net/hubfs/Dark=True%20Medium.png" }, "name" : "OpenVPN" } } ```