Least privilege for AI agents
Least privilege limits an actor's authority to what is needed for its assigned work. For an AI agent, that means considering the effects a tool can cause, the records it can reach, the destinations it can contact, and the duration of access.
A small tool list is not proof of least privilege. One general database or command-execution tool may expose many more actions than several narrowly defined operations. For Model Context Protocol (MCP) deployments, OWASP's guidance recommends minimizing permissions and scoping credentials to the required function.
Explore Dome: Authorization · Docs: Security tutorial.
Start with the job, not the integration
Suppose an agent prepares a daily inventory summary. Its job is to read stock levels and write a report. Connecting it to an inventory system does not mean it needs permission to change stock counts, delete products, or manage users.
List what the job needs to read, change, and send before choosing its tools:
| Dimension | Example limit |
|---|---|
| Operation | Read stock, without changing it |
| Data scope | The warehouses covered by the report |
| Destination | The approved reporting location |
| Volume | A bounded query or export size |
| Duration | The period in which the reporting job is approved |
Bounded autonomy lets the inventory agent choose how to prepare the report within agreed limits. Least privilege gives it the access needed for that job, such as reading stock without changing it. Workflow and approval rules may set additional limits.
These limits describe the approved job. The implementation may distribute them across backend grants, application checks, gateway policy, and resource controls.
Access to the reporting destination also matters. An agent that can read appropriate data but send it anywhere still has broader authority than the task requires.
Explore Dome: Tool Gateway · Docs: Tools gateway.
Test that the job still works
Remove a permission and test both sides of the change. Can the agent still complete the legitimate summary? Can it still make an inventory change that should be forbidden?
If the allowed task fails, investigate which specific capability is missing. Granting administrator access may make the error disappear without showing which permission the job actually needs. A controlled exception should name the missing operation, its owner, and the condition under which it expires or is reviewed.
Keep the summary and inventory-change cases as regression tests when permissions change.
A human approval step can be part of the design for an exceptional operation, but it needs a specific action to approve. Approval to “let the agent continue” may leave it unclear what the agent is allowed to do next.
Explore Dome: Authorization · Docs: Simulate rules.
Review permissions when the task changes
Recheck the inventory agent's access when its tools, credentials, instructions, or reporting destination change. Any of those changes may let it do work outside the original assignment.
Review both direct grants and inherited access. Then check the real routes: a narrow gateway policy does not constrain a separate credential the workload can use directly.
Dome provides scoped access and rules for configured tool and model calls. Its control is useful when the relevant traffic actually uses those paths. The gateway comparison explains how to review coverage; credential isolation explains where credentials are held.
Keep a record of the permissions for that job, who owns them, and how changes are approved. Default-deny answers a related question: what happens when no permission matches a request? Least privilege asks whether the requests that are allowed are appropriately narrow.
Explore Dome: Agent Registry · Docs: Manage agents.