Agents Don't Need Roles. They Need Leases.

AI agents don't need roles, they need leases: authority scoped to a single task, issued when the agent acts, and expired automatically when the call is done, rather than a standing entitlement assigned once and left in place. Role-based access control was built for actors that hold still long enough for a role to describe them: a person with a job title, a service account wired to one integration, an entitlement reviewed on a quarterly cycle. Agents don't hold still. They spin up for a single task, get reconfigured mid-run, pick up a new tool, and spin down, sometimes inside one session. A role assigned at creation is a description of an actor that may not exist an hour later, and a lease is the alternative: authority that expires on its own instead of authority someone has to remember to take away.

The role outlives the reason it was granted

Static roles fail agents in a specific way: they persist past the moment they stopped being justified. A role granted for a task keeps working after the task ends, because nothing in RBAC is scoped to "until this is done." The access sits there, unused but still valid, until someone remembers to revoke it, which is exactly the standing-privilege problem identity teams have spent years trying to close for human accounts. Agents make it worse, not because they're malicious, but because there are more of them, they're created more casually, and nobody is running a quarterly access review on a process that existed for four minutes.

A role answers "what is this actor allowed to do." It never answers "for how long," and for something that might not exist by the time you ask, that's the question that matters.

What a lease grants instead of a role

A lease is scoped to the task, not the identity. It's issued when the agent needs to act, carries only the authority that specific action requires, and expires without anyone needing to remember to take it away. There's no standing credential to leak, because there's no standing credential, period, and no privilege to review months later, because the privilege was never meant to outlive the call it was issued for. The agent that requested a database read a minute ago doesn't hold a database credential now; it holds nothing, until the next call requests exactly what that call needs.

This is a smaller shift in mechanism than it sounds, and a bigger shift in posture: instead of asking "who is this and what have we decided they can do," the system asks "what does this specific action need, right now, and does it get exactly that." The agent's authority becomes a property of the moment it's acting in, not an entitlement attached to an identity that was true when someone set it up and may not be true anymore.

Roles don't disappear, they stop being the standing grant

None of this means identity stops mattering. An agent still needs to prove who it is before anything gets brokered to it, and someone still needs a record of what actually happened. What changes is what the identity check is used for: not to hand out a durable role, but to authorize a lease, one call at a time, scoped to what that call actually needs and gone once it's over. That's the difference between an access model built for actors that hold still and one built for actors that don't.

Sources

• Role Based Access Control. NIST Computer Security Resource Center. NIST's history and reference material on the RBAC model.
• Leases: an efficient fault-tolerant mechanism for distributed file cache consistency. Cary Gray and David Cheriton, ACM SOSP, 1989. The original lease mechanism: a time-limited grant that lapses on its own.
• Basic Principles of Information Protection. Jerome Saltzer and Michael Schroeder, Proceedings of the IEEE, 1975. Least privilege: every program and every user should operate using the least set of privileges necessary to complete the job.
• Security Best Practices. Model Context Protocol documentation, version 2026-07-28. Its scope minimization section recommends a minimal initial scope set with incremental elevation when privileged operations are first attempted.