principle of least privilege (PoLP)

basicwidespread

Security principle: everyone and every program – including the AI agent – should receive only the access strictly necessary for their task.

In plain terms

If you hire a painter for the living room, you give them the house key, but not the safe code, your bank card, or the car keys. Not because you assume they will do something wrong, but because they do not need these for painting. This is the principle of least privilege.

In the computer world, the same applies to people, programs, and AI agents. If an agent's job is to summarize your incoming emails, it needs to be able to read them, but it should not delete, forward, or reply on your behalf.

The principle does not make the agent infallible, but limits the potential scale of damage. An agent can err, misinterpret an instruction, or be deceived by malicious text. In such cases, what matters is what it can access: it cannot break what it has no right to, so with a narrow scope, the trouble remains small.

How it works

First, define the task precisely: what the human, program, or agent must do and what access it needs to do it.
By default, nothing is permitted, and you grant only the necessary rights individually: for example, read access without write access, a single folder instead of the entire machine.
For sensitive operations (payment, deletion, sending emails), you set up separate approval, meaning the agent stops and asks you.
Permissions should ideally be temporary: they expire or are revoked after the task ends, so no forgotten door remains open.
Occasionally, you review who has access to what and revoke permissions that are no longer used.

An everyday example

You install a flashlight app on your phone, and it requests access to your contacts and location. If you deny it, the principle of least privilege is applied, as neither is needed for lighting. The same applies when an AI assistant requests your entire mailbox and calendar just to schedule a single appointment.

Who is affected

everyoneEvery application and AI assistant requests permissions from you, and you decide whether it receives access to what it does not actually need.

entrepreneur, executiveIf a colleague's account is compromised or an agent is deceived, narrowly defined permissions determine whether only a folder or the entire company's data assets are at risk.

developerA coding agent executes commands and writes files on your machine, so you must configure what it can and cannot access. → Code

employeeThis means you cannot see everything in corporate systems, and you sometimes need to request special access. → Work & HR

A common misconception

MythNarrow permissions signal distrust and only slow down work.

In realityThe principle is not about intentions, but about ensuring that damage remains small in case of error, mistake, or attack. When properly configured, it is barely noticeable, as you receive what you need for your work.

Limits and risks

It does not protect against everything: within the granted permissions, the agent can still make mistakes or misuse data.
Overly strict settings are inconvenient, and people tend to bypass them—for example, by allowing everything just to avoid being bothered by many questions.
Over time, permissions accumulate unnoticed, so without regular review, the principle remains valid only on paper.
With an AI agent, it is difficult to predict in advance what will be needed for an open-ended task, so many grant it more access than necessary.

Similar, but not the same

zero trust – Zero trust is a comprehensive security approach that re-verifies every access request; the principle of least privilege is only one of its building blocks.
sandbox – A sandbox is an isolated execution environment, that is, a technical tool; the principle of least privilege is the rule itself, which can be enforced using, among other things, a sandbox.
need-to-know principle – The principle of need-to-know concerns what information you can see, while the principle of least privilege also concerns what operations you can perform.

Related concepts

Broader

cybersecurity, access control, AI safety

Narrower

role-based access control, tool permissions, temporary authorization

On the edge

zero trust, sandbox, human approval, prompt injection, guardrail

A brief history

The principle was described by Jerome Saltzer in 1974 in a paper on protecting the Multics system. It became widely known through a study he published jointly with Michael Schroeder in 1975 on the protection of information, which lists it among the design principles for secure systems. Since then it has been one of the foundational tenets of computer security, and the emergence of AI agents has put it back in the spotlight.

Where things stand

In traditional computing, this has been a basic requirement for decades, referenced by standards and regulations. For AI agents, practice is still forming by the end of 2026: tools offer permission settings, but many users grant overly broad access for convenience.

Status: 2026 November

Also known as

principle of least privilege · least privilege · principle of least privilege · principle of least privilege · principle of least privilege · least privilege · PoLP · principle of least authority (POLA)

Sources

NIST Computer Security Resource Center – Glossary: least privilege

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.