THE QUESTION, ANSWERED
CAN AN AI AGENT HAVE WRITE ACCESS TO ACTIVE DIRECTORY SAFELY?
Yes, on two conditions. The agent gets a scoped identity that can write only where its task needs, and every write it proposes is checked against a rule before it reaches the directory: routine changes allowed on their own, the ones that matter held for a named administrator, and all of it in the record. Write access without the second condition is a service account with an imagination.
What the guidance already says
Microsoft's Active Directory security guidance is the right starting point: least privilege, no standing membership in the privileged groups, tiered administration, delegation at the unit level rather than domain-wide rights, and monitoring of the privileged paths. Its newer guidance for agents adds unique agent identities, task-scoped authorization, allowlists for high-impact actions and time-limited elevation.
All of it applies to an agent. None of it is enough on its own.
Where the guidance stops
Delegation gives the agent the right to create users in a unit. It does not say which users, how many, or whether the one it is creating now happens to mirror an administrator. Monitoring tells you afterward. The gap is the write itself, the moment after the agent has decided and before the directory changes, and the identity controls do not sit there.
The pattern that works
- Scope the identity. One agent, one account, rights on the units it works in and nothing above them.
- Write the rules in plain English, by whoever owns the directory. "Routine account creation in the student unit runs on its own." "Group membership changes wait for a person." "Privileged accounts are never touched by an agent."
- Check every write before it runs. ALLOW the routine ones. HOLD the ones the rule names, for a named administrator, with what they need to decide on one screen. BLOCK the rest, and the retry. Why hold, not modify.
- Keep the record. Every proposed write, the rule, the outcome, who released it, when. What an auditor will ask for.
The published scenario
A regulated document agent with write access to the directory on day one, under GLBA, at a state agency and a university: which writes run on their own, which wait, and what the record shows. Regulated document agents with write access. Every recorded run, misses included, is at the proof page.
Common questions
Can an AI agent have write access to Active Directory safely?
Yes, if every directory write the agent proposes is checked against a rule before it runs and the ones that matter are held for a person. Give the agent a scoped identity that can write only to the units it needs, then put the check between its decision and the directory. Creating a user in a scoped unit can be allowed on its own. Changing group membership, resetting a credential or touching a privileged account is held until a named administrator releases it, and every attempt, run or not, is in the record.
What is the difference between least privilege and a check on the action?
Least privilege decides what the agent can reach in the directory. The check decides whether this write, right now, runs. An agent with legitimate rights to create users can still create the wrong one, or ten of them, or one that is a copy of an administrator. Rights do not see that. A rule about the action does.
Does holding directory writes for a person slow the work down?
Only the writes your rule names. Everything else is checked and allowed on its own. In the published scenario the agent creates and updates routine accounts autonomously and stops for a person only on group membership, credentials and privileged accounts, which is a small share of what it does in a day.
The product, if you want it
Mountain Theory is the check described above, shipped. It works with any AI you already use, in your environment or the cloud.