Least privilege for AI agents
The principle that an agent gets only the tools, files, network destinations and credentials its task needs, for only as long as it needs them. An agent's next action is chosen by a model reading untrusted input, so its permissions, not its intentions, set the worst case; that makes least privilege the main control for excessive agency.
How MoorAI handles it: MoorAI's agent entitlement envelope declares each agent's authorised tools, path prefixes and MCP servers, and flags or blocks an action outside it.
Sources
Related terms
-
Permission right-sizing
Defence & response
Cutting the permissions an agent is granted down to the ones it uses: comparing what a configuration allows — tools, commands, directories, MCP servers…
-
Excessive agency
Attack concepts
The OWASP Top 10 for LLM Applications entry (LLM06:2025) for a system that can be made to take damaging actions in response to unexpected, ambiguous or…
-
Agent sandbox
Agents & architecture
An isolation boundary around the commands an agent runs — an operating-system sandbox profile, a container or a microVM — that limits which files they can…
Defence & response
The vocabulary of running controls for agents: knowing what AI is present, cutting what it may do down to what it uses, catching misuse, and reconstructing an incident afterwards. Where MoorAI implements a term, a separate line under the definition says how; the definition itself stays vendor-neutral. To check one agent's configuration against these ideas, use the free permission right-sizer.