Agent Permission AuditHow to find the permissions an agent actually uses
The granted list is easy: it's in the policy or app registration. The needed list takes one of these sources. Paste both into the permission diff.
AWS
IAM shows last-accessed information for the services and, for some services, the actions an identity used. IAM Access Analyzer can generate a policy from CloudTrail activity: paste that generated policy as the needed list.
Microsoft Entra ID and Microsoft Graph
The app registration lists granted API permissions. For the needed list, take the Graph calls the agent's code makes and look up the least-privileged permission for each in the Microsoft Graph permissions reference.
The OAuth client or domain-wide delegation entry lists granted scopes. For each API method the agent calls, the OAuth scopes list shows the narrowest scope that works (often a .readonly form).
GitHub
A fine-grained token or GitHub App lists its permissions per area. The permissions required for each REST endpoint tell you the minimum for the endpoints the agent calls.
Agents built on MCP servers or tool lists
List the tools the agent actually calls (from its logs), then the permissions each tool's credential needs for those calls. Remove tools the agent never calls before narrowing scopes.