Least Privilege
Least privilege for AI agents starts at the capability boundary.
An agent with a narrowly scoped token can still be overpowered if the token unlocks operations the workflow never needed. Least privilege should constrain the full capability set, not only the credential format.
Capability first
Ask “what can it do?” before “what token does it use?”
API operations are the concrete actions available to an agent. Reading customer data, issuing refunds, deleting users, rotating credentials, or changing access policy are different capabilities even when they share the same authentication scheme.
Minimize operations
Do not expose endpoints unrelated to the agent’s task.
Minimize permissions
Prefer operation-appropriate scopes and avoid broad administrative alternatives where narrower access exists.
Minimize data
Return only records and fields required for the task, with runtime ownership checks where needed.
High-impact actions
Separate ordinary tool use from actions that change real-world state.
Financial, destructive, privileged, credential-management, and sensitive-data operations deserve stronger review because a model can invoke a legitimate tool incorrectly without exploiting the API.
Consider human approval, transaction ceilings, idempotency, stronger authorization context, or a separate execution service. Those are runtime controls; OpenAPI can help identify where they may be needed but cannot prove they exist.
Permission semantics
Broad labels are a review signal, not a universal vulnerability.
A scope such as admin, *, or full_access is worth reviewing because it may grant more authority than an operation requires. Context still matters: judge a permission against the operation and runtime enforcement model, not against a keyword alone.
Keep it least-privileged
Review capability changes, not only initial setup.
New endpoints and scopes can silently expand what an agent is able to request. Treat the approved API contract as a baseline and compare candidate changes before merge.
Gate capability drift
Compare baseline and candidate contracts in CI.
Secure the full integration
Connect least privilege to runtime guardrails and review.