The principle is established security practice. The NIST glossary definition of least privilege limits users and processes to the minimum resources required for assigned tasks. Agent systems need the same discipline because models can choose actions dynamically and process untrusted instructions.
What should be scoped for an AI agent?
Scope the agent identity, permitted tools, allowed methods, target resources, data fields, transaction values, environment, and credential lifetime. A calendar-booking agent may create meetings in one calendar but should not read every mailbox or administer the workspace. Access should match the current task, not the full authority of the represented person.
Narrow tool interfaces help. Expose a limited approved operation instead of a generic database shell or administrator API.
How should agent authorization work?
Agent authorization should evaluate each sensitive action against identity, task, resource, and context. Prefer short-lived credentials minted for a bounded operation over long-lived secrets placed in prompts or environment files. Do not give an agent a human administrator account because it acts for that person.
Separate read and write permissions, production and test environments, and ordinary and exceptional actions. Revoke access when the run ends or the task changes.
Where does human approval fit?
Tool approval can authorize a specific high-impact exception such as a payment, publication, deletion, or account change. The approval should display the exact action, target, and consequence. Approval is not a substitute for least privilege because a broad tool remains broad after one click.
Use approval together with technical enforcement. A reviewer should not be asked to compensate for an agent that can reach unrelated systems or change parameters after approval.
How should teams verify least privilege over time?
AI agent security reviews should compare granted access with observed use, remove unused permissions, test blocked paths, and confirm that new tools default to no access. Monitor combinations of individually harmless data that become sensitive when aggregated. Permission should shrink when the task changes, not accumulate across sessions.
Test prompt injection and tool-confusion cases to confirm that hostile content cannot expand authority. Keep an audit trail of grants, denials, approvals, and revocations. The goal is not to predict every model mistake. It is to constrain the maximum damage one mistake can produce.