Wiki
Core11 min read

Permissions and least privilege

Granting a tool is granting power. The privilege ladder — read liberally, write narrowly, destructive behind a human — is the agent version of database grants.

The moment an agent can act, its permissions become the security boundary. A model that can only read is a research assistant; a model that can send email, move money, or delete files is a principal in your system, and it should be treated like one. The principle is old — least privilege — but agents make it urgent, because the thing holding the credential can be persuaded.

Start here

A tool the agent never had is a tool it cannot be tricked into calling. The strongest safety property is not a filter on a dangerous tool — it is not shipping the dangerous tool at all, or shipping it behind a human.

One agent, one policy — what is it allowed to do?

Reads allowed; writes pause for a human; destructive calls blocked.

get_weather(city="Pune")
readruns
search_orders(id="#1234")
readruns
send_email(to="customer@example.com")
writeasks a human
delete_file(path="/data/report.csv")
destructiveblocked
transfer_funds(amount=4200)
destructiveblocked

Least privilege in one sentence: grant the narrowest tool that does the job, default-deny the destructive ones, and require a human for anything you cannot undo. A tool the agent never had is a tool it cannot be tricked into calling. Policy shown is illustrative — your real allowlist belongs in code, not the prompt.

Switch the policy and watch the same batch of calls move between "runs", "asks a human", and "blocked".

The privilege ladder

Sort every tool by what a mistake costs:

  • Read — fetching, searching, listing. Cheap to get wrong, so grant these liberally; they are what makes the agent useful.
  • Write — sending, posting, creating, updating. Reversible with effort, so grant narrowly and log every call.
  • Destructive — deleting, paying, transferring, deploying. Often irreversible, so put a human in front and default-deny.

Allowlists and scopes

The mistake is a global grant. "Can send email" is dangerous; "can send email to addresses in the customer's own record, templated, rate- limited" is a capability you can reason about. Prefer:

  • Scoped tools — this directory, these recipients, this account.
  • Allowlists over blocklists — enumerate what is permitted, not what is forbidden.
  • Rate and amount limits — a cap on how much, how often, how many.

Careful

Default-deny, confirm what you cannot undo, and log every call with its arguments. If a tool is dangerous enough that you are relying on the model's judgement not to misuse it, the design is wrong — move the decision into code or in front of a human. Permissions are enforced by the harness, never requested politely in the prompt.

Check yourself

Eduspheria wiki · Agentic AI, Safety & deployment

0 / 4 answered

  1. 1According to the privilege ladder, how should destructive tools be treated?
    Multiple choice
  2. 2A scoped tool that can only email addresses on the customer's record is safer than a global 'can send email' grant.
    True / false
  3. 3What security principle says grant only the access needed for the task?
    Short answer
  4. 4Which is preferred for tool permissions?
    Multiple choice

Next: what happens when the tool is code execution — sandboxing.