Least privilege
Least privilege is the principle of giving an agent only the rights it needs for a specific task, and only for as long as it needs them.
The principle comes from information security; NIST describes it as restricting access to the rights a task requires. For AI agents, it means narrow action types, amount limits, permitted counterparties and short validity instead of blanket access.
The narrower the limits, the smaller the damage when an agent makes a mistake or is manipulated. At the same time, every action becomes verifiable, because it is clear what was allowed.
Example
Instead of card access without a limit, a travel agent receives a mandate for train tickets up to CHF 80, valid until the end of the month and with one provider only. Even if the agent is manipulated, it can order neither a flight nor goods.
How it differs
Blanket authority gives an agent far-reaching, unlimited rights; least privilege is its opposite. Role-based rights grant bundles by function, while least privilege trims them to the individual task.
In practice
- Tailor mandates to one task and issue new mandates for new tasks instead of widening existing ones.
- Set validity periods of hours or days instead of months wherever the task allows.
- Review mandates regularly and revoke all that are no longer needed.
Role in KYA
KYA checks every action against the limits of the mandate: action type, amount, counterparty and validity. The narrower the mandate, the more meaningful the certificate.
Related check: Scope of the action (intent_scope). Is the action within the mandate's action type, amount limit, currency and counterparty?
Mandates with narrow limits per task are issued, for example, by the reference implementation Mandact (from the operator of KYA).
Frequently asked questions
What does least privilege mean for AI agents?
An agent receives only the rights it needs for a specific task: certain actions, amount limits, permitted counterparties and short validity.
Why is least privilege so important for agents?
Because agents can make mistakes or be manipulated. Narrow limits contain the possible damage and make every action verifiable.
How is least privilege put into practice?
With mandates per task instead of blanket access, with limits and an expiry date, with a decision before every execution, and with the option to revoke a mandate at any time.
Does least privilege slow agents down?
Hardly, if mandates are well tailored. An agent receives exactly what each task requires; if it needs more, a new mandate or an escalation to a person follows.