An internal bot made me audit our AI agents. The IAM scope was way bigger than it needed to be

Found the thing that finally made me take AI agent security seriously, and its not some fancy attack, its just how much access we hand these things by default. So we had an internal ai agent. Its job was just to read one table and post a summary to Slack. When I looked at what it could do, it was running under a broad IAM role, keys scoped way wider than the read only thing it needed, and it could reach data it never touches for its job. The worst thing is that no one had ever thought of auditing it. It just sat there doing its thing with permissions nobody remembered granting. That sent me down the rabbit hole. Every agent framework we run basically inherits whatever identity the developer attached, so the blast radius is the union of everything that identity can reach. Least privilege for humans is a whole discipline. For agents its still the wild west. How are you all handling this. Auditing agent identities on a schedule, scoping them down at creation, or something else?