Giving an AI agent only the access and actions its task needs, under its own identity, so that a mistake or an attack can do little harm.
Definition
Least privilege is the security principle that a person or system should have only the access needed to do its job, and no more. For an AI agent it means its own account, not a person’s login; only the systems and actions the task needs; the narrowest scope, such as read before write, draft before send, or one folder rather than the whole drive; short-lived credentials rather than standing access; and a person approving anything hard to undo. Because an agent can be steered by what it reads, limiting what it can do limits what an injected instruction can achieve.
History
The principle was set out in computer security in the 1970s and is part of modern security standards and zero-trust thinking. It became central for AI agents as they gained the ability to act through tools, which AI risk lists describe as excessive agency.
When to Use
Apply it at design time for every agent or integration, and review permissions at each change and at least yearly.
Step-by-Step
- Give the agent its own identity.
- List the actions the task needs and grant only those.
- Narrow the scope of each action.
- Use short-lived, scoped credentials kept in a vault.
- Put a person in front of hard-to-undo actions.
- Set limits on steps, time, spend, and rate.
- Review and remove permissions that are not used.
Examples
- A purchasing agent that can create draft orders but cannot change supplier bank details.
- An email assistant that can read and draft but must have a person send anything outside the company.
Common Pitfalls
- Shared logins.
- Broad access to save rework.
- Standing credentials that never expire.
- Permissions never reviewed.