12 minute read
There is a counterintuitive truth in agentic system design: the agents that work best are the ones with the most constrained access.
This sounds backwards. If an agent can do more, surely it is more capable? In practice, the opposite is true — and understanding why will change how you think about deploying AI in your organization.
What Least Privilege Means
The principle is borrowed from security engineering: any system, human or automated, should have access to the minimum set of resources it needs to do its job and no more. A billing agent might need to read billing records without any write access. If it must create an invoice, that write tool is approved individually — not as a blanket “can write billing” grant. It should not have access to user authentication systems or code deployment pipelines.
This is not just about preventing catastrophic failures (though it does that). It is about designing systems that are predictable, auditable, and trustworthy.
How We Ship Least Privilege
On every deployment, our permission standard includes four controls beyond “scope the agent”:
- Read and write permissions are separated — an agent can read a system without write access to it.
- Every write tool is individually approved — no blanket write grant.
- Destructive and irreversible actions receive separate controls — beyond ordinary write access.
- Permission increases require evidence and approval — scope expands only with a recorded rationale and sign-off.
Those standards live in our Operator’s AI Governance Checklist and on how we govern deployments.
Why Narrow Access Produces Better Agents
When an agent has broad access, every action it takes carries ambiguity. Did it do what it was supposed to? Did it touch something it should not have? Was that side effect intentional?
When an agent has narrow access, its action space is well-defined. You can reason about what it did and did not do. You can audit its behavior against its scope. When something goes wrong — and eventually something will — the blast radius is contained.
More importantly: narrow access forces you to design your agentic workflows deliberately. You cannot hand an agent a master key and call it done. You have to think through exactly what the agent needs to accomplish its task, which means you have to understand the task clearly. That clarity is where reliable automation comes from.
The Governance Connection
Least privilege is not just a technical control. It is an organizational commitment. Every agent scope needs to be reviewed by the team responsible for the underlying process. That review is where you catch the cases where "just give it access to everything" would have created a system that nobody actually understands.
Least-privilege design is built into every system we ship. Let us show you what that looks like in practice.