Least Privilege Execution

The foundational information security concept requiring that every module, process, or user be granted only the minimum access rights necessary to perform its function. In agentic systems, this extends to tool access, API scopes, and data read/write permissions. Violations occur when agents hold blanket admin tokens instead of narrowly scoped, task-specific credentials. The principle limits blast radius—if an agent is compromised via prompt injection, the attacker inherits only the agent's restricted capabilities, not full system access.

An access control paradigm that assigns permissions to roles rather than individual identities. For agentic workflows:

• Define roles like read-only-analyst, code-executor, database-writer
• Bind each agent instance to exactly one role per session
• Rotate role assignments based on task context RBAC enables dynamic privilege elevation—an agent starts with minimal rights and requests temporary escalation only when a specific tool call requires it, with automatic revocation upon completion.

A security model where access is granted through unforgeable tokens (capabilities) that both designate a resource and specify the permitted operations. Unlike ACLs, capabilities are transferable and revocable. In agent systems:

• Each tool invocation carries a cryptographically signed capability
• Agents cannot access resources they haven't received a capability for
• Capabilities can be attenuated—a parent capability for file:/reports/* can spawn a child limited to file:/reports/q3/* with read-only rights This model prevents confused deputy attacks where an agent tricks a privileged service into misusing its authority.

A security mechanism that runs agent-generated code or tool calls inside an isolated, ephemeral environment—such as a Docker container, gVisor sandbox, or Firecracker microVM. Key properties:

• No network egress by default
• Read-only root filesystem with temporary writable layers
• Resource limits on CPU, memory, and execution time
• System call filtering via seccomp profiles Combined with least privilege, sandboxing ensures that even if an agent escapes its permission boundaries, it remains confined to a disposable environment with no access to host systems or sensitive data.

A security practice where elevated permissions are granted on-demand and time-bound rather than provisioned persistently. In agentic systems:

• An agent requests a specific permission before executing a high-risk tool call
• A policy engine evaluates the request against context (time, task, resource)
• Access is granted for a narrow window (e.g., 5 minutes) and automatically revoked
• All grants are logged for auditability JIT eliminates standing privileges—the primary vector for lateral movement. Tools like HashiCorp Vault and AWS IAM Roles Anywhere implement JIT patterns for machine identities.

A control point in an agentic workflow that requires explicit validation before a high-stakes operation proceeds. Action gates enforce least privilege by:

• Intercepting tool calls that exceed a risk threshold
• Routing decisions to a human reviewer or policy engine
• Requiring cryptographic approval before execution
• Logging the decision rationale for compliance Example: An agent drafting a database migration plan can query schemas freely, but the DROP TABLE command triggers an action gate requiring SRE approval. This implements separation of duties—the agent proposes, but a higher authority disposes.