Giving an agent broad credentials is convenient and dangerous. Capability-based access grants only what a specific task needs, and only for as long as needed.
The principle of least privilege
An agent should have the minimum permissions required for its current job. If it only needs to read one folder, it should not be able to read the whole drive.
What a capability is
A capability is an unforgeable token that grants a specific right, for example "read this document" or "post to this channel". Holding the token is what authorizes the action.
Applying it to agents
- Issue short-lived, narrowly scoped credentials per task.
- Bind permissions to the user the agent acts for, not to a powerful shared account.
- Expose the model to tools that are already restricted, such as a read-only database role.
- Check authorization in the tool layer, not in the prompt.
Why this limits damage
If an agent is tricked by prompt injection or makes a mistake, the harm is bounded by what its capabilities allow. Narrow permissions turn a potential disaster into a contained error.
Operational practices
- Keep a list of tools and the permissions each needs.
- Review and expire credentials regularly.
- Log every use of a capability.
- Separate read tools from write tools.
Takeaway
Security for agents is mostly about what they are able to do, so design permissions before you write prompts.
Continue with the book
Explore the full treatment, worked examples, and exercises in Building Production-Grade AI Agents.
Adapted from Building Production-Grade AI Agents, published by Choral Software. Article text and original examples © 2026 Choral Software. All rights reserved.