Least Privilege
Least privilege means giving an entity only the access and authority it needs for its assigned task. For an agent application, this can limit the tools, data, or operations available to it.
[NIST]In practice · hypothetical example
A reporting assistant receives read-only access to the reporting dataset rather than administrator access to the entire database.
[NIST]A little deeper
The principle concerns granted permissions. Asking an overprivileged agent to be careful does not reduce those permissions. [NIST]
A common mix-up
Careful instructions are equivalent to restricted permissions.
Instructions do not remove capabilities granted by the system. [NIST]
Which choice follows least privilege for a reporting task?
Sources & editorial notes
Evidence: supported. Primary-source support for this scoped entry; publication approved by the project owner.
- Least privilege ↗ (opens in new tab)NIST · Publication date unknown
Relevant section: Definitions
Last editorial review: 2026-09-13 by project-owner.
First observed in this corpus: Unknown.
Revision history
Revision 2 · Created 2026-09-13 · Updated 2026-09-13
Project owner approved the current content for publication. Existing evidence scope and limitations remain applicable.