Least privilege for AI agents: give it only what the job needs

Least privilege is one of the oldest rules in computer security. Jerome Saltzer and Michael Schroeder wrote it down in 1975. Every program and every user should run with the smallest set of privileges the job needs, and no more.

Fifty years later it still holds. But AI agents bend it in a new way.

Why agents are different

A normal program does what its code says. An agent decides what to do as it goes. It reads something, picks a tool, acts, then reads the result and picks again. Whatever it can reach, it can use. Whatever it can use, it can break.

The OWASP project that tracks risks in AI applications has a name for this. It calls it excessive agency, and it comes from three things. Too many functions, too many permissions and too much autonomy.

Least privilege, one layer up

Most guides stop at permissions. Which keys, which APIs, which folders. That's the floor, and you need it.

But an agent is also shaped by what it can see. Every document, chat log and folder you hand it becomes part of how it decides. Hand it the whole drive and it'll use the whole drive, including the old draft with the wrong price on it.

That's the idea behind Least Context. Give an agent the least context and authority its task needs, and no more. Least privilege covers what it can touch. Least context covers what it can see.

Ask a kid to find something in the house and you get chaos. Ask them to find it in one room and they find it.

What it looks like in practice

One job per agent. An agent that answers support questions doesn't need your billing system. Split the jobs and each one gets a smaller room.

Its own key. Never hand an agent your admin login. Give it its own credentials with only the scopes it needs. Then you can see exactly what it did, and shut it off without breaking anything else.

Read first, write later. Start every agent read only. Add write access to one place when it's earned it.

Access that expires. Grant it when the task starts and take it back when the task ends. Standing access is how a small mistake turns into a big one.

Only the files it needs. Point it at the folder for this job, not the drive. If it needs something else, it can ask.

A wall, not a request. "Please don't touch production" in a prompt is a request. A permission it doesn't have is a wall. Instructions fade over a long session. Walls don't.

It makes the work better, too

Least privilege usually gets sold as security. It's also quality. A smaller room means fewer places to look and fewer wrong answers. Less to read means less to miss. And a smaller reach means a smaller mess when something does go wrong.

You get all three from the same move. Give it the room, not the house.

Sources: Saltzer and Schroeder, "The Protection of Information in Computer Systems," 1975. OWASP Gen AI Security Project, LLM06:2025 Excessive Agency.