How to find and remove unused permissions from an AI agent

[thegdsks]

Agents collect permissions because widening a grant is easier than finding the narrow one, and the audit log already records what each agent used. This guide finds grants that were never exercised, proposes a smaller set, and replays the recorded decisions against it before you change anything. The example runs in memory with no model and no API key.

In the example an agent holds ten single action grants and makes 498 calls. Five grants are never used, including tool:billing * and tool:db:users delete. The proposal keeps three permissions, and the preview flags three newly denied query tool:db:users calls so you can decide before applying.

Limits: it proves past behavior only, rare but legitimate calls may fall outside your window, and rate limits and approvals are not re-evaluated in the replay.

Policy shrink is available in @glinr/theauth 1.2.0.

npm i @glinr/theauth

Full step by step tutorial: https://docs.theauth.dev/tutorials/remove-unused-agent-permissions
Runnable example: https://github.com/glincker/theauth/tree/main/examples/policy-shrink

Questions or edge cases you want covered? Reply here.