Least privilege

#How least privilege works

Start from the task. List what the agent must read and what it must change. Remove everything else. Limit each credential and tool to the smallest scope that still works. Review the list when the task changes, and remove access that is no longer used. Least privilege is a habit as much as a setting, because access tends to grow when nobody reviews it.

#Why it matters for AI agents

Agents often run with broad access: a logged-in browser, an API key or a shell. If an agent is tricked by injected text or makes a mistake, that broad access is what turns the error into harm. Narrow access keeps a bad step small. Read-only access is safer than write access for the same task, because a read cannot change data on the site.

#Wield and least privilege

Wield limits what each recipe can do. A recipe sends requests only to the https origins it lists, and redirects to other hosts are not followed. Requests may not set Cookie or Host headers. Each run has fixed limits: 12 steps, 40 requests, 5 MB per response and 60 seconds. Wield never reads, copies or sends cookies or passwords. Any write needs the user's Allow. On paid plans, an organization admin can restrict allowed sites, require approval for writes and turn telemetry off for every member.

#Related terms

• Human-in-the-loop: the approval step for the actions that remain after access is narrowed.
• Prompt injection: the attack that least privilege limits the damage from.
• Audit log: the record that shows which access was used and when.

#FAQ

#How do I apply least privilege to an AI agent?

Give the agent only the tools it needs for the task. Limit each tool to the sites and actions it requires. Require approval for writes. Keep a log of what the agent does. Review the access again when the task changes.

#Is read-only safer?

For the same task, yes. A read-only tool cannot change data on a site, so a mistake or an injected instruction does less harm. Many tasks need a write at some point, though. For those steps, keep the write behind an approval, so a person sees it before it happens.