You Need Least Agency: Least Privilege Isn't Enough for Airline AI Agents

Least privilege has been a core security principle for decades, and it applies to every AI airline agent just as it applies to every human user. An AI agent shouldn't hold permissions beyond what its task requires, and trimming over-permissioned AI agents is one of the highest-value quick wins available to any airline security team.

Here's what the industry has been slow to acknowledge: correctly implemented least privilege still isn't sufficient. An AI airline agent can stay entirely inside its authorized permission set and still behave in ways that are wrong for its purpose. The permission boundary marks the outer limit of what the AI agent can reach. It says nothing about how the AI agent reasons within that space, how it sequences its actions, how it reacts to adversarial input, or whether the combined effect of many individually permitted actions matches the reason it was deployed.

An AI agent that can refund shouldn't automatically be able to refund any amount. That gap is what least agency is designed to close.

What Least Agency Means for an AI Airline Agent

Least agency governs behavior. It asks not "what can this AI airline agent access?" but "what autonomous actions should it be permitted to take, in what sequence, under what conditions, and subject to what oversight?" It scopes what AI agents do, not just what they can reach.

The practical difference shows up quickly in a contact center. Picture an AI rebooking agent that has the right to issue compensation, correctly granted under least privilege because its job is to resolve disruptions. Now suppose a crafted passenger message steers it into issuing a payout on every claim it touches, each one just under the amount that would draw attention. Every action is authorized. The behavior is still inappropriate. This is an illustrative scenario, not an incident Zenity has observed at any airline. Least privilege says the access was allowed; least agency asks whether the behavior was appropriate.

Airlines are putting AI agents in front of passengers and into core operations faster than almost any other industry, and many of them write directly to passenger name record (PNR), passenger service system (PSS), and loyalty platforms. Because those systems record real money and real seats, the gap between what an AI agent may do and what it should do is a financial exposure, not an abstract one.

Scope Creep Is the Silent Accumulation Problem

Preventing scope creep is a continuous governance challenge. AI agents evolve, pick up new tasks, and connect to new systems, and their effective scope tends to expand along the way. Without checkpoints that require explicit justification for each expansion, an AI airline agent accumulates capabilities that were never formally authorized and may never have been reviewed. That risk is sharpest in the fast-built AI agents that product and customer experience teams launch on vendor contact-center platforms or homegrown stacks such as LangChain and Databricks, often with little security review.

The data from adjacent identity research is stark. Entro Security's research found that 97% of non-human identities (NHIs) carry excessive privileges. More than 5.5% of Amazon Web Services (AWS) NHIs are full administrators, and in some organizations that rate reaches 18%. These super NHIs didn't start that way. They accumulated permissions through deadline pressure, convenience decisions, and the absence of governance checkpoints that would have caught the drift.

Maintaining least agency means treating scope changes to an existing AI agent with the same rigor as the launch of a new one. The AI refund agent that gained a new tool integration six months ago without a security review now has an effective scope nobody approved. That's an unreviewed AI agent wearing a reviewed AI agent's badge.

Enforcing Least Agency With JIT Access and Dynamic Scoping

Just-in-time (JIT) access and dynamic scoping are the operational mechanisms that put least agency to work at runtime. An AI airline agent handling a rebooking doesn't need access to loyalty accounts, payments, or crew systems, even if its service account technically has permissions there. Dynamic scoping narrows the AI agent's effective authority to the task in front of it, and tightens that scope as the task progresses.

Applied to money, this is what makes the refund sentence above enforceable. Rather than granting refund authority once and letting an AI agent exercise it indefinitely, a dynamic model ties authority to the specific passenger, the specific disruption event, and a ceiling on value. Every refund, rebooking, and data-access action gets a deterministic allow, modify, or block decision tied to real identity and session context. A request above the limit is modified down to it or blocked, and authority is withdrawn when the task ends. Because the limit lives outside the model, it holds regardless of what the AI agent decides.

Enforcement works best when it starts with discovery. Surfacing every AI agent that can touch a reservation, a refund, or a loyalty account, including the Shadow AI that teams stood up on their own, is what tells you where to apply these limits first.

The Least Agency Ratio: A Metric Worth Tracking

The most useful number for the board conversation on agentic AI risk is the least agency ratio: the measured gap between what an AI agent is permitted to access and how much of that access it's allowed to act on autonomously, evaluated per AI agent at runtime.

Most airlines have no visibility into that ratio today, which means no way to know whether their AI agent fleet operates within acceptable risk parameters. Reporting it by AI agent class, instead of as one enterprise-wide average, shows exactly where behavioral limits aren't keeping pace with permissions: which class of AI airline agent, which platform, which business unit. That's the data a chief information security officer (CISO) needs to make a credible case for investment, and it speaks to the digital leaders who want to keep scaling self-service without a security incident forcing a slowdown.

Decision Budgets for Delegation Chains

Multi-agent architectures add a further problem: autonomous scope compounds across delegation chains. Imagine an orchestrator that hands a disruption case to an AI fare-calculation agent, which hands it off to an AI compensation agent, which hands it off to a AI payments agent. Each hop extends the autonomous decision-making in play. The chain as a whole can exercise far more autonomy than any single AI agent was authorized to, and far more than the passenger or the airline ever intended to delegate.

Decision budgets treat autonomous authority as a finite resource, allocated at the top of the chain and consumed as it passes through each delegation. When the budget runs out, the chain returns to a human decision point before it continues. In an airline setting, that might mean a ceiling on the total value of refunds and compensation an interaction can authorize, whatever the number of AI agents involved. It extends the same behavioral limit to the chain as a whole, so the combined effect of sequential delegations stays within bounds a human set at the outset.

When something does go wrong, the final layer is evidence. A full decision-chain record of every refund issued, compensation calculated, and data accessed lets security teams reconstruct what happened in minutes, correct the action before the next AI agent runs, and answer review by the U.S. Department of Transportation (DOT) or under EU261, the European Union's passenger compensation regulation, as well as Payment Card Industry (PCI), General Data Protection Regulation (GDPR), and California Consumer Privacy Act (CCPA) requirements.

Least privilege decides which doors an AI airline agent can open. Least agency decides what it's allowed to do once it's through, and how much it can spend on the way.

Permissions tell you what an agent can reach. They don’t tell you what it’s actually doing with that access. Get your fleet’s least agency ratio.

See your AI agent exposure → Zenity for Airlines