Least privilege for agent tools

Least privilege means the agent can only do what this task for this user requires. Mechanisms: expose a per-task subset of tools rather than the whole catalogue; back tools with credentials scoped to the user's own permissions (the agent acts as the user, not as an admin); split read and write tools so read-only tasks never carry write capability; and constrain arguments (tenant id injected by the tool handler, not supplied by the model). See Tool Permissions and Least Privilege and Permissions, Authentication and Authorisation.

It is harder than for a service because the caller is a model that decides at runtime what to call with what arguments, influenced by content it reads. A service calls the database the way its code says; an agent may call delete because a document told it to. So the permission boundary must be enforced in the tool layer and the backend, never by the prompt, and should assume adversarial arguments.

Operationally: credentials stay in the tool server, short-lived tokens per run, audit logs of every tool call with arguments, and alerts on calls outside the task's expected set.