A Permission-Aware Security Framework for Autonomous AI Agents in Software Systems

Autonomous AI agents increasingly interact with software tools, APIs, files, and external services, creating security risks when agents are granted broader permissions than required for a specific task. This paper proposes the Permission-Aware Agent Security Framework (PAASF), a fine-grained authorization framework designed to control agent actions according to task, resource, and operation scope. The framework follows least privilege and deny-by-default principles, distinguishes read and write operations, and supports explicit escalation for sensitive actions. A prototype benchmark was developed to compare unrestricted access, static least-privilege policies, and task-scoped PAASF using legitimate and unauthorized tool requests. The prototype results show that both static least-privilege and PAASF blocked all unauthorized requests in the evaluated workload, while maintaining full task utility. PAASF introduced a small increase in authorization-decision latency due to its finer-grained policy checks. These findings indicate that task-scoped authorization can provide a practical security control for autonomous AI agents, while further evaluation on larger and more realistic workloads is required