AI glossary · Basic · AI security · Agents
Principle of least privilege
The principle of least privilege is a security principle of giving people or programs only as much permission as they strictly need to do their job. For AI agents, it means opening up only the tools and data they need.
About this term
- Level
- Basic · Technical terms you often meet in AI news
- Category
- Security & safety
- Fields
- AI security, Agents
- Added
- 2026-10-09
How it works
First, lay out what each user, service and agent does, then grant only the permissions needed for that work. If only reading is needed, do not grant write access; if only a specific folder is needed, do not open the entire drive. Where possible, make permissions valid only for a short period and revoke them when the work is done. For AI agents, narrow the list of usable tools, the range of accessible data and the network destinations separately, and run risky operations only inside a sandbox.
Agent permission check
Scope
- Are only the needed tools opened?
- Is write access withheld when only reading is needed?
- Does data access stay within the user's permissions?
Operations
- Do permissions have an expiration period?
- Are risky operations run in a sandbox?
- Are unused permissions revoked regularly?
Why it matters
The starting point of modern security is assuming that any system can eventually be fooled or breached. With fewer permissions, the damage is smaller even when an incident occurs. Because AI agents can be fooled by text alone, as with prompt injection, limiting what they can do in the first place is far more reliable than trusting the model to judge correctly. This principle is also a basic element of zero trust security, which verifies every access every time.
Things to know
If permissions are too narrow, work keeps getting blocked, which easily backfires as people get annoyed and grant broad permissions all at once. So a realistic approach is to start narrow and widen as needed while documenting the reasons. When an agent works on behalf of a user, the agent's permissions must not exceed that user's permissions. It is also important to review regularly so that unused permissions do not pile up.
Example
When adopting coding agents at a company, many teams let the agent modify files only inside the project folder and block commands such as deployment or payments entirely. For an internal document assistant, the connection is set up so that only documents the asking employee could already view are searched. This way, even if the agent is fooled by a poisoned document, the data it can extract and the actions it can take are limited from the start.