# Least privilege

Read tools are free to use. Write tools (delete, refund, send email) need human approval. Never give an agent more permission than its user has.

AI developers · Part 09: Production · Card 3 of 13 · Last updated 2026-10-13

## Analogy

A read-only database user for the analytics dashboard. Nobody needs DROP TABLE to draw a chart.

## In an agent

Limits the blast radius when the agent is confused or tricked.

## Practice

### Flashcards

- **Interview: four guardrails against harmful actions?** Step limits, Zod validation of arguments, least-privilege tools with approval for writes, and treating tool output as untrusted.
- **Interview: how do you defend against prompt injection?** Separate data from instructions, limit tool permissions, require approval for sensitive actions, filter outputs.

### Interview questions

**How do you stop an agent doing something harmful?**

- A maximum step limit.
- Zod validation of every tool argument.
- Least-privilege tools and human approval for write actions.
- Treat all tool output as untrusted data to defend against prompt injection.

**What is prompt injection?**

- Malicious instructions hidden in content the agent reads, like a web page saying "ignore previous instructions".
- Defend by separating data from instructions and limiting tool permissions.
- Require approval for sensitive actions and filter outputs.

## Questions people ask

### What is least privilege for AI agents?

Give each tool and each agent only the access it needs, and never more than the user it acts for. Read tools can run freely. Write tools, such as delete, refund or send email, need human approval. If the agent is confused or tricked, the possible damage stays small.

### Should an agent use the same permissions as the user?

At most the same, and usually fewer. The agent should act on the user's behalf, so it must never see data or perform actions the user could not. Use scoped tokens or read-only database users for read tools, and keep powerful write access behind an approval step.

## Related concepts

- [Guardrails](https://studyvisually.com/learn/tech/ai-developers/production/guardrails)
- [Prompt injection](https://studyvisually.com/learn/tech/ai-developers/production/prompt-injection)
- [Human-in-the-loop](https://studyvisually.com/learn/tech/ai-developers/agents/human-in-the-loop)
- [Validate tool arguments](https://studyvisually.com/learn/tech/ai-developers/production/validate-tool-arguments)

Web page: https://studyvisually.com/learn/tech/ai-developers/production/least-privilege
Study this card in the app: https://studyvisually.com/app/learn?category=ai-developers&card=least-privilege