What is least privilege?
Least privilege is the security principle that every person, service, and AI agent receives only the access its task requires, for only as long as the task lasts. It is a founding idea of zero trust and is enforced through role-based access control (RBAC), narrowly scoped API tokens, read-only database accounts, and credentials that expire.
The principle matters even more for AI agents. A language model can be steered by prompt injection or can misread a request, so its prompt cannot serve as a security control. The permissions on its credentials set the real limit on what a manipulated or mistaken agent can do.
Least privilege in practice
A regional health system deploys an agent that helps schedulers fill cancelled appointments from a waitlist. The agent can read the calendar and the waitlist and propose bookings for a scheduler to confirm. It cannot see clinical notes or billing records and has no bulk export tool, in line with the minimum necessary standard in HIPAA. An instruction hidden in a patient portal message therefore has no route to clinical data. Kirk Tech Solutions typically starts agents with read-only access and adds each write permission separately, behind an approval step.
What to watch for
- Give each agent its own identity rather than a shared service account, so its permissions can be scoped and its actions traced.
- Make sure an agent acting for a user never holds more access than that user has.
- Review grants regularly, because access added for a one-time project tends to stay.