CORE GUIDE
Least privilege for AI capabilities
Give an AI system only the permissions required for the current task, for the shortest practical scope, with stronger gates around irreversible effects.
Mental model
Permission is a runtime capability, not a sentence in the prompt. Least privilege narrows what the system can actually do even when the model is confused, manipulated or simply wrong.
Why it matters
Prompt instructions can influence model behavior but cannot provide a hard security boundary. If one tool credential can read every customer, delete data and transfer money, a single planning error or prompt-injection path can become a high-impact incident. Narrow scopes, temporary capabilities and action-specific approval reduce the blast radius independently of model intent.
01
Constrain identity, scope and action
Map each task to the minimum resources and operations it needs. Issue scoped credentials or capability handles, separate read from write permissions, and keep destructive or high-value operations behind explicit approval or stronger policy checks. Enforce limits in the runtime or external service so a model cannot expand its authority by requesting a different action in natural language.
02
Example: support agent account access
A support agent may read the current customer's subscription and issue a small bounded credit. It cannot enumerate all customers, change account ownership or invoke a general payment API. A refund above the threshold requires a separate approved capability. Even if malicious retrieved text asks for broader access, the runtime has no such permission to grant.
Common failure modes
- Giving one broad API key to every agent tool because it is operationally convenient.
- Relying on system-prompt warnings instead of permission enforcement.
- Keeping elevated capabilities alive after the task that required them is complete.
Engineering heuristics
- Separate read, write and destructive capabilities wherever practical.
- Scope permissions by user, resource, amount and time when the domain supports it.
- Treat approval as capability issuance, not merely conversational consent.
Takeaways
- 01Least privilege reduces blast radius independently of model quality.
- 02Permissions belong to runtime enforcement.
- 03High-impact actions should require narrower and more explicit capabilities.
Used in
This Concept is reused across these canonical learning paths.
Related concepts from the Knowledge Graph
These relationships come from the canonical graph, not a separate Guide taxonomy.