What is a Least Privilege Agent Access?

AI agents introduce a new wrinkle to the classic least-privilege principle: an agent's behavior is driven by a language model interpreting instructions, which means it can be manipulated by prompt injection embedded in a document, email, or web page it reads during a task. If that agent holds broad standing permissions — full database write access, every connected integration, unrestricted file-system reach — a successful injection can escalate far beyond the original task's blast radius, so the permission boundary has to be enforced outside the model's judgment, not inside it. Practical implementations scope permissions per session or per task rather than per agent identity: an agent handling a read-only research task gets no write tools loaded at all, and an agent authorized to send email gets that single capability rather than a bundle of unrelated integrations. Tool access should also be revocable and auditable in real time, since an agent mid-task behaving unexpectedly needs a kill switch that doesn't depend on the agent cooperating with its own shutdown.