Least Privilege
Least privilege means giving each agent only the minimum permissions needed to complete its task. This limits the blast radius if an agent is compromised or makes a mistake.
Applying Least Privilege
- Start with no permissions: add only what is demonstrably needed for the task
- Grant read before write: if a task can be done by reading, do not grant write access
- Use scoped API keys: request only the OAuth scopes or API key permissions needed
- Time-limit permissions: grant elevated permissions only for the duration of the task
- Audit permission usage: review which permissions were used; revoke unused ones
- Never grant admin permissions for routine tasks: reserve full access for exceptional cases
Least Privilege in Practice
BAD — over-privileged support agent:
Permissions: read_all, write_all, delete_all, send_email, access_finance, issue_refund
GOOD — correctly scoped support agent:
Permissions: read_orders, read_customers, send_email (with approval gate), issue_refund (≤ $100 only)
BAD — one API key used by all agents:
API_KEY = "sk-super-admin-key-with-all-access"
GOOD — separate, scoped keys per agent:
RESEARCH_API_KEY = "sk-read-only-search-key"
SUPPORT_API_KEY = "sk-support-read-write-limited"
REPORT_API_KEY = "sk-read-only-report-key"
Each key is created with only the scopes that agent needs.
Key Takeaways
- Least privilege means giving each agent only the minimum permissions needed to complete its task.
- Start with no permissions: add only what is demonstrably needed for the task
- Grant read before write: if a task can be done by reading, do not grant write access
- Use scoped API keys: request only the OAuth scopes or API key permissions needed