The Permission You Forgot You Granted
As agentic tooling matured this week, the recurring risk was not model failure but scope creep in the permissions granted during setup.
16 July 2026 — Somewhere in your business there is an integration that can read more than it needs to, and nobody remembers deciding that.
This week's technical reporting kept circling the same finding from different angles. The failures that matter in agentic systems are rarely failures of intelligence. They are failures of scope — a connector granted access to a folder rather than a file, an API key scoped to an account rather than a task, an agent given write access because asking for read-only would have required a conversation.
The conversation is the point. Every permission that skips it becomes invisible, and invisible permissions are the ones that turn a contained incident into an unbounded one.
There is a simple discipline that costs almost nothing and catches most of this: for every integration, write down three things — what it can read, what it can write, and who decided. If the third answer is "nobody in particular", that is the finding. It does not require a security assessment. It requires an honest look at a settings page.
The other thread this week was regulatory, and it connected. The August deadline asks whether you have adequate controls over your AI systems. A control is not a policy describing what should happen; it is a boundary that holds when tested. A permission nobody reviewed is not a control, it is an assumption.
What this means if you run an SME. Open the integration settings of your main platform this week and read the scope list. Revoke anything broader than the task requires. Then note who granted the remaining access. The exercise takes twenty minutes and it is the single most efficient security improvement available to a small business — no tool, no consultant, no budget line.
Weekly review from the mid-week signal archive.