What is Permission Creep (Agent)?
The gradual accumulation of MCP tool permissions over time as new capabilities are added to an agent's configuration but old, unnecessary ones are never revoked. A common problem in long-running agent deployments.
WHY IT MATTERS
Permission creep is a well-known problem in traditional IT — employees accumulate access rights as they change roles, and nobody revokes the old ones. The same dynamic plays out with AI agents, often faster.
A development team adds a new MCP server for a specific task. The agent's configuration is updated to include it. The task completes, but the server stays in the configuration. Months later, the agent has access to fifteen servers when it actively uses three. Each unused permission is latent risk — attack surface that serves no operational purpose.
With AI agents, permission creep is accelerated by the pace of tooling. New MCP servers are published weekly. Developers experiment by adding them to agent configurations. The configuration file grows monotonically — additions are common, removals are rare. Nobody audits agent permissions because it is not obviously broken.
The compounding effect is what makes permission creep dangerous. Each individual addition seems reasonable. The aggregate creates an agent with access to file systems, databases, APIs, cloud infrastructure, and communication tools — far beyond any single task's requirements.
HOW POLICYLAYER USES THIS
PolicyLayer combats permission creep by decoupling tool access from MCP client configuration. Even if an agent's client config lists many servers, the JSON policy on each grant defines what is actually permitted. Policy changes are made and schema-validated in the dashboard, and the Raw JSON view exposes the exact document for review, making permission additions visible and auditable. Regular policy audits are straightforward — compare the policy allowlist against actual tool usage from PolicyLayer's audit logs to identify permissions that should be revoked.