Least privilege for AI agents: start with the smallest access

Least privilege means giving an AI agent only the access needed for its assigned task. Apply it to data, tools, destinations and duration. An assistant that prepares a report does not automatically need permission to delete records or send the report to anyone it chooses.

Separate access by action

Imagine a sales assistant reading approved CRM notes and preparing follow-up drafts. Reading account history, updating deal value and emailing a prospect are different permissions. Granting one should not silently grant the others.

Document the smallest useful workflow first. Then map each step to a permission rather than beginning with administrator access and trying to restrict behavior through prose.

Use an access worksheet

• Resource: the folder, account or record collection required.
• Action: read, create draft, update, send or delete.
• Scope: allowed customers, destinations and fields.
• Duration: ongoing access or a bounded session.
• Owner: the person who grants, reviews and revokes it.

Where a provider offers broad permissions only, compensate with narrower application controls and explicit review. Document the remaining exposure instead of pretending the connector is more limited than it is.

Test denial without breaking the workflow

Ask the agent to read a permitted test record and an excluded one. Try an allowed draft action and a prohibited send. Inspect the backend result, not only the assistant's refusal text. The important question is whether the unauthorized action can execute.

Repeat after changing account membership. Access rules that worked during setup can become stale as teams change.

Review permissions as part of maintenance

Remove connections no longer used and check for expanded scopes after integration updates. Keep an accessible record of why each permission exists. This makes onboarding faster, incident investigation clearer and offboarding less dependent on the memory of the person who originally connected the tools.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.