Principle of Least Privilege

The principle of least privilege requires an AI agent to receive only the tool permissions necessary to perform its assigned task. Access should be limited to the required actions, resources and duration, rather than granting broad authority merely because a tool is available.

What minimum tool access means

Permissions should reflect the agent's specific job, not every capability offered by a connected service.

• An agent that only retrieves information should have read-only access, without permission to modify or delete it.
• Access should be restricted to the necessary files, databases, accounts or other resources, rather than an entire system.
• Permissions to send messages, execute commands or make payments should be granted only when the assigned task requires those actions.
• Administrative privileges should not be the default for routine tasks.

How access should be controlled

Access controls must enforce these limits independently of the agent's reasoning; an instruction telling the agent to behave safely is not an authorization boundary.

• Use narrowly scoped credentials and withdraw permissions when they are no longer needed.
• Require explicit authorization before expanding access beyond the original task; consequential actions can additionally require human approval.
• Record privileged actions so that their use can be reviewed and investigated.

Why it matters for AI agents

An agent may make mistakes or be manipulated by malicious instructions in material it processes. Least privilege limits the potential damage by restricting what the agent can actually access or change. It is a safeguard, not a guarantee of correct behaviour, and should complement monitoring and oversight.