Glossary · Security and risks
Least privilege
Least privilege is a security principle that gives a system only the access needed for its assigned task. For an AI agent, it means limiting the information it can read, the operations it can perform and, where supported, how long those permissions remain available.
Least privilege: the explanation
Start with the assignment and identify the access genuinely needed to complete it. An agent summarizing documents may need to read them without being able to delete them. A scheduling assistant may need availability information without permission to change every event. These limits should be enforced through accounts, services or tools. The [NIST glossary](https://csrc.nist.gov/glossary/term/least_privilege) describes the principle in terms of restricting privileges to the minimum necessary for assigned functions, rather than relying on a promise to behave cautiously.
The principle comes from computer security and applies to people and conventional programs as well. With agents, it helps separate broad decision-making capabilities from broad access to your resources. Permissions might cover a particular folder, a category of information or a specific operation. When connecting a service, distinguish reading records from changing or transmitting them. This makes it easier to see which capabilities are necessary for your current request and which would go beyond it.
The necessary minimum depends on the assignment and can change when you expand the work. Overly narrow access can prevent legitimate progress, while overly broad access increases possible consequences if something goes wrong. You therefore need a way to examine access failures and add a specific capability when justified. Reduced privileges do not make an answer accurate. They primarily bound what the system can reach or affect while it acts on your behalf during the task.
A concrete example
You ask an agent to find receipts for a business trip. You provide read access to the relevant folder, without access to other folders or permission to delete files. It prepares a separate summary. If you later ask it to share that summary, the new operation requires suitable access to the chosen destination and sending method, rather than unrestricted authority over the whole account.
Why it matters
Least privilege helps you compare requested permissions with the value a tool provides. Broad access for a narrow assignment deserves closer examination. Check whether permissions can be separated, reviewed and revoked. Proportionate access reduces the potential reach of a mistaken action and helps you understand what you are actually entrusting to an agent or connected service when you authorize it to do work.
Common misconceptions
- A capable agent does not need every permission you hold, because deciding which action would help and having authority to perform that action are separate matters that should remain proportionate to the task you assigned.
- Read-only access is not free of risk, because the information being read may be sensitive and a response or separately permitted transmission could expose it to people who were not intended to receive it.
Related terms: security and risks
- guardrails
- Guardrails are measures that constrain how an AI system behaves and which actions it can perform.
- sandbox
- A sandbox is an execution environment that restricts what a program can access or change beyond its assigned boundaries.
- prompt injection
- Prompt injection is an attempt to redirect an AI system through instructions placed in material it processes.
- API key
- An API key is an identifier that software sends when accessing certain online services.
- OAuth
- OAuth is an authorization framework that lets an application obtain limited access to another service.
Where this site covers it
The term appears on 3,608 pages of this site. A few of them:
- Securing an AI agent: permissions, secrets, sandboxing, human approval, and logging Guide
- Choosing an MCP server: trust, maintenance, permissions, and local or remote hosting Guide
- Claude Code reference guide: installation, subscriptions and API access, commands, CLAUDE.md, MCP, subagents, and best practices Guide
- Codex CLI reference guide: installation, approvals, sandboxing, AGENTS.md, and costs Guide
- Hosting an AI agent on a VPS: server selection, installation, security, backups, and costs Guide
- OpenClaw reference guide: installation, configuration, models, skills, messaging, security, and costs Guide
- AI agents and the GDPR: what data leaves, and where does it go? Article
- Run an AI agent in a sandbox Article
Go further
Frequently asked questions
Does it just mean read-only access?
No. Read-only access is one possible restriction. The principle can also limit folders, recipients, operations or the duration of access, depending on the service’s capabilities and what the assigned task actually requires to succeed.
Can permissions be expanded later?
Yes, when the system supports it. Add the specific capability that has become necessary rather than replacing limited access with unrestricted authority, and remove that capability when the task no longer needs it.
How can you check the permissions?
Review connection settings, account authorizations and the service’s access information. Also consider indirect access, such as shared folders, because these can make the effective scope broader than the permission label initially suggests to you.
Neutrality. No affiliate links. No vendor pays to be reviewed, rated or ranked. Reviews are directed by François Chollet, neutral and factual, and every data point is dated and sourced. How we score