Which practices reflect the principle of least privilege applied to an agent's tool set?

**Least privilege** is a security rule that says give any actor only the access it needs for the job in front of it, and nothing more. For an AI agent, the "access" is its set of tools, the files those tools can read, and the systems they can call. Three of the listed practices follow this rule. Registering only the tools the current task needs keeps the agent from doing things outside its job. Sandboxing restricts which filesystem paths and network endpoints a tool can reach, so even an allowed tool cannot wander. Requiring human approval before irreversible actions, like deleting data or sending money, adds a checkpoint where a person can stop a mistake. Two practices do the opposite. Giving the agent every tool "just in case" expands what can go wrong if the agent is confused or tricked. Using a larger model improves its reasoning, but it does not change what the agent is allowed to touch. The key idea is that the security perimeter is about permissions, not intelligence. A smarter agent with too many tools is still dangerous, because one bad decision or one injected instruction can now reach far more systems.

**Least privilege** scopes an agent's authority to the minimum needed for the current task. The correct practices are task scoped tool registration, runtime sandboxing, and human approval on irreversible actions. Task scoped registration limits which tools the agent can even call. Sandboxing limits what a called tool can actually touch, such as filesystem paths and network endpoints. Approval gates put a human in front of any action that cannot be undone. Together these shrink the blast radius if the agent errs or is hijacked. The two distractors fail for different reasons. Giving the agent all tools "in case scope expands" directly violates least privilege. It widens the attack surface for no benefit on the task at hand. The larger model option is the subtle trap. A bigger model reasons better about which tool to call. It does not change which tools exist or what they can reach. Capability is not a permission boundary. The mental model is layered defence. Registration controls what the agent can attempt. Sandboxing controls what succeeds. Approval controls what becomes permanent. Each layer assumes the one before it can fail.