Least Privilege

What is least privilege?

Would you hand the cleaning person every key to your house? Of course not — they only need the front door. The principle of least privilege is the same idea: an agent gets just enough access to do its current job, and nothing more.

Why not just grant everything and save the hassle?

Agents make mistakes
Even a clever model misreads intent and calls the wrong tool. The more access it has, the costlier a single slip.
Agents can be misled
Prompt injection can push an agent into unexpected actions. Less access means less room for an attacker to exploit.
Accountability stays manageable
When something breaks, clear permission boundaries make it easier to find who did what and where.

How to put it into practice

Authorize per task, not per identity
Not "this agent is an admin" but "this task needs to read those two files".
Issue temporary access and revoke it
Hand out short-lived credentials at the start of a task and revoke them when it's done — no standing access.
Deny by default
Anything not explicitly allowed is blocked. Better to ask again than to let it through.

How it fits with zero trust

Least privilege is a cornerstone of zero trust: trust no component, authorize every action explicitly, and grant only the "just enough" scope.

Bottom line: least privilege is "if one is enough, never grant ten."