Least Privilege
The security principle that an identity — human or agent — should hold only the access it needs for its task, and no more. For AI agents it's the single highest-leverage control, because agents chain tools: the blast radius of a compromised agent is the *union* of every scope it can reach, so every unnecessary permission compounds. Least privilege is exactly what shadow agents skip — they typically borrow a human's full OAuth grant (an agent that needs to draft replies in one label inherits the entire mailbox, drive, and calendar). Enforcing it means giving each agent its own scoped Non-Human Identity (NHI) with narrow, short-lived, revocable permissions rather than a broad standing token. Pairs with approval gates for irreversible actions and sandboxing for code execution.
Written by Max Zeshut
Founder at Agentmelt · Last updated Sep 9, 2026
Example
A finance reconciliation agent needs to read the bank feed and write to a staging ledger — nothing else. Least privilege gives it read-only access to the bank API and write access to one ledger table, with no ability to move money or touch the general ledger. If prompt-injected, it can dirty a staging table (recoverable) but can't initiate a payment.
Frequently asked questions
- How is least privilege different for agents than for humans?
- The principle is identical; the failure mode is worse. Agents act faster, chain more tools, and run unattended, so an over-privileged agent does more damage per second than an over-privileged human and with no one watching. Agents also lack the offboarding signals humans have, so a too-broad grant tends to persist. That's why scoped, short-lived non-human identities matter more for agents than static service accounts ever did.