Least Privilege
Least privilege for AI agents starts at the capability boundary.
An agent with a narrowly scoped token can still be overpowered if that token unlocks operations the workflow never needed. Constrain the full capability set, not only the credential format.
Ask “what can it do?” before “what token does it use?”
Minimize operations
Do not expose endpoints unrelated to the agent’s task.
Minimize permissions
Prefer operation-appropriate scopes over broad administrative alternatives.
Minimize data
Return only records and fields required for the task, with runtime ownership checks where needed.
Separate ordinary tool use from actions that change real-world state.
Financial, destructive, privileged, credential-management, and sensitive-data operations deserve stronger review. Human approval and transaction limits are runtime controls; OpenAPI only helps identify where they may be needed.
Broad labels are a review signal, not a universal vulnerability.
Scopes such as admin, *, or full_access need context. Judge permissions against the operation and effective runtime enforcement, not a keyword alone.
Review capability changes, not only initial setup.
New endpoints and scopes can silently expand what an agent may request. Compare candidate changes against an approved contract baseline.
Least privilege is end-to-end: contract scope, identity, authorization, data access, network context and runtime approval all contribute to effective capability.