Least privilege for AI agents

The question How much access should an agent get?

Why an agent breaks least privilege by default

A coding agent runs as a process under your user account. Whatever you can open, it can open: SSH keys, cloud credentials, .env files, tokens in your shell profile. Whatever those keys reach, the agent reaches too.

NIST's least-privilege control already covers this case. Control AC-6 in SP 800-53 allows "only authorized accesses for users (or processes acting on behalf of users)" that their assigned tasks need. An agent is exactly such a process. Handing it everything its user holds is the opposite.

The cost can arrive in seconds. In April 2026, a Cursor agent running Claude Opus 4.6 hit a credential mismatch in the PocketOS staging environment. It went looking for an API token and found a Railway token in an unrelated file. The token had been created to add and remove custom domains, but it was scoped for any operation. One API call deleted the production database and its volume-level backups. The founder said it took nine seconds, and that Railway helped restore the data within an hour. He named his own part plainly: "the unknown exposure to a production API key". The case is one of 38 in GIRD's incident dossier.

Agents touch credentials in ordinary work too. GIRD's case study followed one company's engineering laptops in observation mode, with nothing blocked. Agents' own processes opened password and key files 19 times in one week and 29 times the next, across six files. For everything else an agent can touch, see What can an AI coding agent reach on a laptop?

Give each agent its own identity

A coding agent on a laptop acts as the person who started it. It uses that person's Git credentials, cloud session and API keys. Your logs then name the person, and you can't revoke the agent without locking the person out.

OWASP's Top 10 for Agentic Applications lists this as ASI03, Identity and Privilege Abuse. Without "a distinct, governed identity of its own", it says, an agent sits in an attribution gap where true least privilege is impossible.

So treat each agent as a non-human identity. Give it separate credentials: its own Git token or bot account, cloud role and API keys. NIST's discussion of AC-6 points the same way: organisations consider creating extra roles and accounts where least privilege needs them. Then scope those credentials twice.

• By team. The agent gets its owner's team policy, not the owner's personal access. A platform engineer's agent may reach staging infrastructure. An analyst's agent reaches the warehouse read replica. Neither reaches production credentials by default.
• By task. Fixing a failing test needs the repository and the test runner, not cloud keys or a production database. OWASP's first mitigation for ASI03 is short-lived, narrowly scoped tokens issued per task.

What least privilege looks like for an agent

Each control below closes one path an agent inherits from its user.

Read-only is not safe on its own, because reading is how keys leak. A key the agent reads goes into its next model request and its transcript, as Where AI agents leak your keys shows. MCP servers carry risks of their own, covered in What is MCP, and how do MCP servers create risk?

OWASP's guidance on LLM06:2025, Excessive Agency, lines up with this list. It says to minimise extensions and their permissions, and to have a person approve high-impact actions. It also says to enforce authorization in downstream systems "rather than relying on an LLM to decide".

What the agents' own settings offer

The main coding agents ship permission controls. Use them as your first layer.

Claude Code has six permission modes. In default mode, Claude asks the first time it uses each tool. In plan mode, it reads and explores but doesn't edit. The bypassPermissions mode skips the prompts. Allow, ask and deny rules apply to a tool or to one use of it, such as Read(./.env) or Bash(git push *). Deny wins over ask, and ask wins over allow. Administrators can deploy managed settings that user and project settings can't override, including one that disables bypass mode.

Codex pairs a sandbox enforced by the operating system with an approval policy. Its sandbox modes are read-only, workspace-write and danger-full-access, and network access is off by default. Approval policies such as on-request and never decide when it stops to ask. Enterprise admins can enforce settings through requirements.toml.

Why settings inside the agent are not enough

Agent settings help. They are not the whole control, for three reasons.

They can be changed. User-level settings live in files that anything running as you can edit, including malware and, in some cases, the agent itself. In 2025, a researcher showed a prompt injection could make GitHub Copilot write "chat.tools.autoApprove": true into its settings. That turned off every confirmation (CVE-2025-53773, since fixed). The Nx supply-chain attack started agents already installed on developers' machines with --dangerously-skip-permissions, --yolo and --trust-all-tools, then had them hunt for secrets.

They stop at the agent's edge. Anthropic's documentation says Claude Code's file deny rules don't cover a script that opens files itself, such as a Python or Node program. For that, it points to the sandbox, which sets limits in the operating system. A setting governs the agent's own tools; the processes it starts need a control of their own.

Not every agent has them. Each agent brings its own settings model, and a script your team writes against a model API has only the controls its author built. In the case study, 8 of the 14 coding agents installed across the laptops recorded no session at all, and all stayed installed. An agent nobody uses keeps whatever settings it shipped with.

So put least privilege where the agent can't switch it off. Put it in the agent's identity, in the operating system for every process it starts, and in the systems it calls. That is what OWASP calls complete mediation: the downstream system decides, not the model. Record each privileged step, as AC-6(9) asks, so you can show who approved what. What an audit trail for AI agents must show covers that record.