Teams say an agent has least privilege because its prompt says "only read customer tickets." Then the process receives a service-account token that can update tickets, export users, and call three internal APIs. The prompt is trying to negotiate with the model. The credential has already made the security decision.
Least privilege for agents means the credential cannot perform actions outside the task, even when the model asks nicely or a prompt injection tells it to.
Size authority to the task
A permanent agent role is usually too broad because agent work is contextual. One task may read invoices for tenant A. Another may draft an email without sending it. Create task-level grants that express the audience, scopes, tenant, resource constraints, and expiry.
{
"sub": "agent:invoice-assistant",
"act": { "sub": "user:123" },
"aud": "https://billing.example.com",
"scope": "invoices:read",
"tenant_id": "tenant-a",
"exp": 1788622800
}Claims are not enough by themselves. The billing API must validate each one and enforce object-level policy. A token saying tenant-a should never be accepted for an invoice resolved to tenant-b.
Delegation should only reduce power
When a primary agent calls a sub-agent or tool, do not forward the original token. Exchange it for a downstream token with a smaller audience, shorter lifetime, and only the scope required for that hop. RFC 8693 provides the OAuth token-exchange pattern for this.
This creates a monotonic rule: authority can stay the same or shrink, but it cannot grow during delegation. A calendar-reading agent cannot mint an email-sending token because a model decided that sending a summary would be useful also.
Separate read, draft, and commit actions. Agents can often perform analysis with read access, produce a proposed change without write access, and request a narrowly approved credential only for the final side effect. This reduces standing privilege without making the product unusable.
Remove invisible privilege
Credentials are only one path. Network reachability, filesystem access, inherited cloud roles, plugin permissions, and cached secrets can all bypass the token model. Run agents in constrained environments and inventory the real capabilities available to the process.
Audit denied actions as well as successful ones. Repeated requests for unavailable scopes may reveal a broken workflow or prompt injection. Make revocation task aware so cancelling one agent run does not require disabling the user entirely.
The takeaway is that least privilege is not a static role. It is a property of every task and delegation hop. Give the agent enough authority to complete the approved work, then make everything else technically impossible, full stop.
Akash Devdhar is a Senior Software Engineer specializing in enterprise identity, authentication, authorization, and AI infrastructure. He writes about building secure AI systems using OAuth, OIDC, RBAC, and modern identity architectures.