Least Privilege for LLM Agents

Least privilege is the principle of granting only the permissions required for a task, to the identity that performs it, for the needed duration. For AI agents, the permission boundary should cover more than the model’s tool list: it includes credentials, data collections, external services, writable resources, and the actions available through each connector. A prompt that says “do not delete files” does not prevent a tool call from deleting them if the identity still has that authority. Microsoft’s current guidance for AI agents recommends unique identities, documented purpose and data access, review of effective aggregate permissions, allowlisting tools, and auditing agent actions. It describes scoped read roles for document summarization, separate read and write roles for ticket workflows, and time-limited elevation or approval gates for remediation. These are Microsoft implementation recommendations, but the underlying principle applies across systems: enforce authorization at the tool and downstream service, not only in the orchestration prompt. Start with the smallest useful tool set and resource scope. Separate read and write functions where possible; require explicit approval for destructive, financial, or broad actions. Use short-lived credentials for elevated work, maintain a way to revoke access quickly, and review permissions when data, tools, or workflows change. Log which principal acted and what the downstream system authorized. Least privilege reduces blast radius; it does not prove the agent’s judgment is correct or stop every form of data disclosure. Combine it with input handling, output validation, testing, monitoring, and human confirmation for sensitive operations.