Least Privilege
A security design principle stating that a subject should be granted only the minimum access permissions necessary to complete a task, combined with short lifetimes and revocable mechanisms to reduce the impact of a compromise.
Timeline (last 90 days)
The principle of least privilege includes: limiting token scope (read-only or restricted to a single repository), setting expiration times, preferring OAuth and app-specific passwords over master passwords, and keeping 2FA and payments in human hands.
When an Agent can autonomously open accounts and obtain credentials, the importance of auditing, least privilege, and protection against erroneous operations will only rise, not fall.
Restricting model loading to a dedicated least-privilege service account or using container images that do not mount the home directory can reduce the scope of what the process can access if loading behaves unexpectedly.
The tools available to an agent should be strictly limited to only the functionality it truly needs (least-privilege tool invocation).
Least-privilege tool authorization means an agent can only access the tools and data strictly necessary to complete the current task.
Engineering governance principles should follow the practice of granting capabilities with least privilege, and sensitive operations should have independent checkpoints.
All Facts (6)
The principle of least privilege includes: limiting token scope (read-only or restricted to a single repository), setting expiration times, preferring OAuth and app-specific passwords over master passwords, and keeping 2FA and payments in human hands.
50%UnverifiedWhen an Agent can autonomously open accounts and obtain credentials, the importance of auditing, least privilege, and protection against erroneous operations will only rise, not fall.
50%UnverifiedRestricting model loading to a dedicated least-privilege service account or using container images that do not mount the home directory can reduce the scope of what the process can access if loading behaves unexpectedly.
50%UnverifiedThe tools available to an agent should be strictly limited to only the functionality it truly needs (least-privilege tool invocation).
50%UnverifiedLeast-privilege tool authorization means an agent can only access the tools and data strictly necessary to complete the current task.
50%UnverifiedEngineering governance principles should follow the practice of granting capabilities with least privilege, and sensitive operations should have independent checkpoints.
50%