08.01 · Concept
Least privilege, for a loop
Scope an agent's credentials to the smallest set its task actually needs.
Least privilege for an agent means granting credentials only for the current task: specific resources, actions, inputs and duration. In an agent loop, every tool call can become an access-control decision, so broad tokens turn prompt injection, bad plans or hallucinations into operational risk.
What this lesson answers
- how to scope credentials for an AI agent
- least privilege for agent tool calls
- how to prevent overbroad agent permissions
Notes
Least privilege means giving a program only the authority it needs for the current job, and no more. For an AI agent, the loop matters: the model repeatedly observes, decides, calls tools, reads results, and decides again. If every iteration has access to production databases, deployment keys, email, file systems, and payment APIs, then a bad prompt, hallucinated plan, or injected instruction can turn into real damage. The credential should be scoped to the task, not to the developer’s convenience.
A useful mental model is to treat each tool call like a tiny service account request.
Common questions
- Why is least privilege different for an agent loop?
- An agent does not make a single request and stop. It repeatedly reads context, chooses actions, calls tools and reacts to results. If the same broad credential is available throughout that loop, one compromised step can affect many systems. Each tool call should be constrained to what that step actually needs.
- Is hiding dangerous tools from the prompt enough?
- No. Prompt text is not an access-control boundary. If the runtime can still call a tool using powerful credentials, a prompt injection or bad model decision can reach it. The boundary should be enforced outside the model with scoped tokens, narrow grants, allowlisted operations and approval gates for risky actions.
- What should an agent permission profile include?
- Define the resources the agent may touch, the allowed actions, read versus write separation, input constraints, credential lifetime and environment boundaries. Prefer temporary credentials and small service accounts. For irreversible or costly operations, let the agent prepare a request and require a separate approval step to execute it.
Short definition: what is Least privilege, for a loop?