Least Privilege
A basic principle in the security field whereby any principal should possess only the minimum privileges necessary to complete its task, and those privileges should remain valid only for the shortest necessary period. When applied to AI agents, it must be combined with dynamic authorization.
Timeline (last 90 days)
Least privilege requires each tool to use an independent, scope-limited credential rather than one broad OAuth token covering all services, because once the latter leaks, the attack surface equals the entire set of integrations.
The author proposes three lessons: start with the narrowest permission that supports the entry point, let the backend handle as little data as possible, and list the things you cannot do to build trust.
开发者应默认拒绝而非默认允许代理的权限，行为日志应按审计标准设计，熔断机制需在架构层预留。
All Facts (3)
Least privilege requires each tool to use an independent, scope-limited credential rather than one broad OAuth token covering all services, because once the latter leaks, the attack surface equals the entire set of integrations.
50%UnverifiedThe author proposes three lessons: start with the narrowest permission that supports the entry point, let the backend handle as little data as possible, and list the things you cannot do to build trust.
50%Unverified开发者应默认拒绝而非默认允许代理的权限，行为日志应按审计标准设计，熔断机制需在架构层预留。
50%