A machine worker with yesterday's permission can become today's ungoverned operator without ever breaking a rule.
Permission drift alarms flag mismatches between a machine worker's current job, the systems it can touch, and the approvals that justified that access.
Agents rarely ask for dangerous power in one jump. They accumulate adjacent permissions because each added tool makes the next task easier.
Heads of Growth keep fast autonomous execution without letting old access quietly become a shadow operating model.
Human teams notice when a person changes role. A sales ops contractor moves into customer success, finance asks who owns the seat, IT adjusts groups, and managers re-check authority. Machine workers do not create the same social signal.
An enrichment agent may start with read-only CRM access. Then it gets routing rights to fix bad owner fields. Then it receives email permissions to notify reps. Then it touches nurture queues because response data improves scoring. Every step is practical. Together, the worker now controls part of the revenue system.
The failure is not that the agent became malicious. The failure is that the organization let usefulness masquerade as authorization.
Record the original task, data domain, customer segment, and outcome metric tied to the worker's access.
Compare current tokens, apps, queues, inboxes, write privileges, and API scopes against the approved operating boundary.
Detect new workflows, exception handling, escalations, or customer-facing actions that were not part of the original grant.
Attach review dates, revocation triggers, and automatic downgrade paths to every non-trivial machine-worker permission.
Most operators can spot a new request for production write access. The harder problem is a permission that was reasonable three weeks ago and now sits inside a different workflow. The label stays the same. The consequence changes.
Example: a lifecycle agent was allowed to update trial-stage fields so reps had cleaner follow-up context. Later, the same field triggers automated expansion outreach, discount eligibility, and success handoff timing. The agent still edits a CRM field. It now influences revenue promises.
The exact reason the permission existed: task, customer segment, data class, workflow, and allowed output.
What the worker actually did in the last review window, including downstream automations triggered by its actions.
Any tool, queue, data source, or buyer-facing surface the agent can influence because work expanded around it.
How much customer impact, revenue impact, compliance exposure, or operational reversibility changed since approval.
Renew, narrow, downgrade, escrow behind approval, or revoke the permission before the next autonomous run.
A worker enriches accounts with industry and headcount. Sales trusts the fields, so routing rules start using them. Then territory assignment, sequence selection, and SLA priority inherit the same data. The agent now decides who gets attention, not just what record is complete.
A trial-support worker can summarize tickets, draft replies, and tag urgency. It cannot change plan status, alter renewal risk, or update success commitments unless a fresh permission grant ties the action to evidence and owner approval.
How long each worker has held write access, external-send authority, customer-data scope, or queue-control rights without renewal.
How often current actions fall outside the task, segment, or system boundary described in the original approval.
Which automations, reports, customer messages, or human decisions depend on fields and actions the worker can modify.
Growth stacks are full of dependencies. A field update becomes a routing decision. A routing decision becomes a sequence. A sequence becomes a customer expectation. The permission that looked harmless at the input layer may become material at the outcome layer.
Permission drift alarms turn that hidden composition into an operating discipline. They do not slow every agent down. They force authority to stay attached to the work being performed right now.
For each worker, store the approved job, data class, tools, write surfaces, owner, and expiry date.
Review recent actions against the grant, including indirect effects caused by automation downstream.
When scope is unclear, move the worker to read-only, draft-only, or approval-gated mode until authority is renewed.
Require a human owner to re-approve access when a worker changes task, segment, system, or customer-impact level.
Before machine workers keep long-lived access, install permission drift alarms.