CLAIM-2026-09-18-05

The AEPD's third observation is that an agent obtaining an account, an API key or a token with excessive permissions can operate at machine speed and reach different services before the organisation detects anomalous behaviour.

Why it matters

This is the transferable control. An over-scoped API key or token behaves the same way whether the agent holding it is hostile or is your own CI runner.

Sources

• agenciaespa2026primera