Definition
Least privilege is the practice of giving a person, service, model, or agent only the permissions needed for its current job, and only for as long as the job requires. Jerome Saltzer and Michael Schroeder included it among their influential security design principles in 1975, building on security work already underway in the early 1970s.
For an AI agent, the unit of privilege should be narrow: one run, one tenant, a specific resource, an allowed operation, and a short time window. Read access does not imply write access. Permission to draft does not imply permission to publish. A credential that can perform ten operations is overbroad when the task needs one.
Least privilege limits the damage from prompt injection, model error, compromised tools, and ordinary software defects. It does not prevent those failures; it reduces what they can affect.
Distinguish it from nearby terms
Authentication establishes identity. Authorization decides what that identity may do. Least privilege constrains that authorization. Separation of duties adds an independent actor or approval for sensitive operations.
Check your understanding
An invoice agent needs to read one vendor's invoice and propose a payment, but its token can pay any vendor from any account. The agent has excessive privilege even if a prompt tells it to stay within scope.