Least Privilege
Give the agent the minimum access the task requires.
Scoping credentials, tools and permissions to exactly what the current task needs: a read-only token for a read-only job, one directory rather than the filesystem, an allowlisted network rather than open access.
It matters more for agents than for services because the instruction source is untrusted text. An agent that reads a web page can be talked into using whatever access it holds, so the size of its access is the size of the worst case.
The threat model it addresses is specific: an agent that reads untrusted content can be steered by it, so its access defines the blast radius of a successful injection. Scoping credentials is therefore a security control, not a tidiness preference.
Splitting one powerful agent into two narrow ones
A workflow needs to read external documents and write to an internal system.
Have the reader with network access produce a structured summary, then a separate writer with database access consume only that summary and never the raw documents. Neither agent alone can both be injected and act on it.
Reusing a human’s credentials for an agent because it is quicker. The agent has no judgement about scope, and the audit trail becomes uninterpretable.
- standardLLM01: Prompt injection ↗
Defines direct versus indirect injection and the downstream effects — data disclosure, unauthorised tool use, command execution — with least privilege and human approval as the recommended controls.
- docsComputer use tool ↗
Screenshot, mouse and keyboard as a tool loop, with the safeguards that belong around it: isolated environments, minimal privileges, network limits, human confirmation.
- docsConfigure permissions ↗
Allow, ask and deny rules for edits, shell commands and other tools: what a permission mode looks like when it is written down.
Sandbox
An isolated environment where an agent can act without risk to real systems.
Permission Mode · Autonomy level
How much the agent may do without asking.
Permission Request
The agent pausing to ask before doing something risky.
Guardrails
Constraints on what the system will do, enforced in code.
Data Leakage
Information escaping where it should not.