Least privilege

Least privilege is the principle of giving any actor the minimum access it needs to do its job, and nothing more. Applied to AI agents, it’s the single control that shrinks the blast radius of every future mistake at once: if a capability isn’t granted, no prompt injection, bug, or bad sampling step can use it.

For agents, least privilege starts from zero. A new agent has no capabilities and earns each one deliberately, mapped to its job. This is stricter than the human version because agents can’t be trusted to refrain from using access they happen to have — they’ll use whatever’s in front of them, including when steered by untrusted text.

Least privilege for agents has two layers. The first is the familiar one: don’t grant what the job doesn’t need. The second is specific to agents: don’t even show what you didn’t grant. Ungranted capabilities are filtered from the agent’s tool manifest, so a denied tool becomes a nonexistent one — closing the prompt-injection door before it opens.

In practice, least privilege is implemented through scope and roles, and maintained by watching the denial log, pruning unused grants, and reviewing roles on a cadence. The goal is to make your worst case small, on purpose, in advance.