How does least privilege tool scoping reduce security risk in an agent system?

**Least privilege** means an agent gets only the tools the current task actually needs, and nothing more. A research agent that reads the web does not need a delete-file tool. A summariser does not need a send-email tool. Why does this matter so much for agents? Because an agent is an LLM in a loop, and the LLM decides which tool to call based on the text it reads. That text often comes from the outside world, like a web page or a document. An attacker can hide instructions in that text. This is called prompt injection. If the agent has been handed dangerous tools, a successful injection can trigger them. An agent with read, delete, and send-email can leak or destroy data. The same agent with only a read tool simply cannot, no matter what the model is tricked into wanting. The second benefit is protection from honest mistakes. Even with no attacker, a confused agent might delete the wrong file or send a half-written email. If those tools were never registered, that whole class of accident is impossible. The key idea is that the tool list is your security boundary, not the prompt. You bound the damage by what you hand over.

**Least privilege** means the agent is granted only the tools the current task requires, scoped per task rather than per agent. A file-reading task gets a read tool. It does not get write, delete, or send-email. Over permissioning amplifies two distinct threat vectors. The first is prompt injection blast radius. An agent acts on text it retrieves, and an attacker can plant instructions in that text. A successful injection can reach every registered tool. Three tools means a small blast radius. Twenty tools means a large one. The second is accidental runaway actions. Even with no attacker, a confused model can take an irreversible action that happens to be in scope. Least privilege removes that whole class of accident by construction. It does not rely on the model behaving. The critical framing is that the tool set is an architectural control, not a model behavior one. You do not bound damage by prompting the model to be careful. You bound it by what you register. Implementation has two layers. First, scope tool registrations dynamically per task and unload them afterward. Second, sandbox at the runtime layer, restricting filesystem paths, network egress hosts, and API scopes, so a tool cannot exceed its intended reach.