Authority

Least privilege

Also called: principle of least privilege · PoLP · least authority

DefinitionThe principle of least privilege holds that a process should be given exactly the authority its current task requires, for no longer than the task takes, and nothing else.

Saltzer and Schroeder wrote it down in 1975, and it has been quoted more often than it has been implemented: every program should operate using the least set of privileges necessary to complete its job.

The reason it is quoted more than implemented is that granting narrow authority is more work than granting broad authority, at every layer, forever — and broad authority never fails visibly on the day you grant it.

Three dimensions, not one

Least privilege is usually discussed as “how much”, but a useful grant is bounded in three directions at once.

Scope. Which resource, exactly. Not “the filesystem” but one directory. Not “the network” but one host and port. Not “GitHub” but read access to one repository.

Operation. Read is not write. Write is not delete. A tool that can create a pull request is not a tool that can merge one, and collapsing those into a single “GitHub access” toggle throws away the entire distinction.

Time. The one people skip. Authority granted permanently for a task lasting four minutes is not least privilege in any meaningful sense — it is broad privilege with a narrow origin story. Grants should expire, and expiry should be the default rather than a setting nobody changes.

Why agents make it urgent

The traditional argument for least privilege is blast radius: when something goes wrong, you want the damage bounded. With AI agents there is a second argument that bites sooner.

An agent’s behaviour is generated at runtime, from input that can be attacker-controlled. There is no version of “review the code, then grant it what it needs” because the code that matters does not exist until it runs. The only durable control is the size of what it can reach, which makes least privilege less of a hygiene practice and more of the actual security mechanism.

What it looks like when it is real

A grant that reads like this:

subject   com.anthropic.claude
session   7C4A
domain    filesystem
op        read
resource  inode dev(1,17):8814402
expires   +00:30
uses      1

Bounded in all three dimensions, tied to a verified subject and a live session, and gone in half an hour whether or not anyone remembers it. Compare that with a checkbox labelled “allow file access”, which is the same idea implemented in a way that gives up everything that made it worth having.