Least Privilege Was for Humans. Agents Need Least Agency.

Least privilege assumes a bounded actor. Give a person exactly the access their job requires, and the blast radius stays small, because a human does one thing at a time and gets tired. An agent with the same token does not get tired. It will use every capability that token grants, in every combination, at machine speed, the instant a stray sentence tells it to.

That is the reversal nobody scoped for. You spent a decade shrinking credentials and you shrank the wrong thing. The credential was never the risk once you handed it to something that reasons. The risk is the behavior the credential permits, and the attack that unlocks it does not arrive over the network you inspect. It arrives in the instructions, below every control you own.

Least privilege quietly changed jobs

Least privilege is a scoping rule for a credential. It answers one question: what is this identity allowed to touch. For a human that question is almost the whole game, because the human is a slow, singular actor who reads a screen, forms an intent, clicks once, and moves on. The credential and the behavior are effectively the same object. You bound the access and you have bounded the person.

An agent breaks that equivalence. Give an agent a token scoped to “read customer records and file tickets,” a scope you would sign off on without blinking, and you have not bounded its behavior at all. You have bounded its surface. Inside that surface it can read ten thousand records in a minute, correlate them, summarize them, and file a ticket that exfiltrates the summary to an address it was told to trust, all inside the exact permissions you granted. Nothing exceeded its privilege. The privilege was the ceiling, and the agent lived at the ceiling the whole time, which is something a human almost never does.

I made a version of this argument for the credential itself in When Everything Is Privileged, Nothing Is, about human dual accounts and how just-in-time access fixes the friction of standing power. This is the distinct problem sitting one layer over. That post is about scoping the credential a human holds. This one is about scoping what an agent does with a credential you have already decided to grant. Just-in-time access shrinks the window. It does nothing about the fact that inside the window, the actor is a machine that will take every path the grant leaves open.

The taxonomy already named it

This is not a thought experiment anymore. In December 2025, OWASP published the Top 10 for Agentic Applications, the agent-specific companion to the long-running LLM Top 10. It catalogs the failure modes that are unique to an actor that reasons and acts on its own, ASI01 through ASI10, and reading it back against a traditional access model is uncomfortable, because most of the list is invisible to the controls you already run.

Three of the categories are the spine of the whole problem:

• ASI01, Goal Hijacking. An adversary redirects the agent’s objective. The token is valid, the scope is intact, and the agent is now pursuing the attacker’s goal instead of yours because something it read rewrote its intent.
• ASI02, Tool Misuse. The agent uses its legitimately granted tools in unintended or dangerous ways. Not tools it stole. Tools you gave it, combined in a sequence you never imagined, because you scoped the tools and not the sequences.
• ASI03, Identity and Privilege Abuse. The agent exceeds its authorized scope or impersonates, and OWASP places this in the top tier of risk. Note what “exceeds its scope” means for a reasoning actor: it does not need a privilege escalation exploit. It can chain permitted actions until the aggregate behavior is something you would never have authorized as a single request.

Look at the shape. Every one of these can happen while every access check passes. The credential is behaving. The behavior is not. Least privilege has no opinion about any of it, because least privilege was designed to answer “is this identity allowed to do this,” and the agentic failure mode is “this identity was talked into doing a permitted thing for someone else’s benefit.”

The attack arrives in the instructions

Here is the part that should change how you draw your threat model. The delivery mechanism for goal hijacking is not a packet your firewall can read. It is language, and it enters through the one channel an agent cannot refuse to process: its input.

Prompt injection is the input-layer attack surface, and it is genuinely new in a way that keeps tripping traditional security teams. A prompt injection is an instruction hidden in content the agent ingests. A support ticket, a web page it browses, a PDF it summarizes, a code comment, a calendar invite. The agent cannot cleanly separate “data I was asked to process” from “instructions I should follow,” because to a language model both are just text in the context window. The malicious sentence sits in the data and says, in effect, ignore your prior task, do this instead, and the agent, being helpful, does. That is ASI01 in one move, delivered as content.

Tool poisoning is the same idea aimed at the agent’s capabilities rather than its goal. The description of a tool, the metadata of an MCP server, the schema the agent reads to learn how to call something, all of it is text the agent trusts to decide what a tool does and when to use it. Corrupt that description and you have reprogrammed the agent’s use of a legitimate tool without touching the tool’s code. The agent still holds a valid token. You have just rewritten, from the outside, what it does with that token.

I walked through why this surface is invisible to network-based defenses in What witness.ai Doesn’t See. The short version is that a network proxy inspects the transport, and the injection is not in the transport. It is in the payload the agent was supposed to read. By the time the malicious instruction is doing damage, it has already been decrypted, delivered, and interpreted as intent. It arrived below every network control you own, riding legitimately on content the agent was explicitly asked to consume.

Least agency is the design response

If the problem is behavior rather than access, the control has to bind behavior. That is what “least agency” names: grant an agent the minimum capability it needs to accomplish a specific task, for the duration of that task, and no standing latitude beyond it. Least privilege asks what an identity may touch. Least agency asks what this agent may do, right now, toward this goal, and refuses to answer once.

The distinction is not semantic. It changes what you build:

• Scope the task, not the identity. A standing agent with a broad token is the worst case, because its agency is permanent and general. A task-scoped agent gets a narrow grant tied to one job and loses it when the job ends. The unit of authorization stops being the identity and becomes the intent.
• Constrain tool composition, not just tool access. Least privilege lists the tools an agent may call. Least agency governs the sequences. An agent that may read records and may send messages should not automatically be allowed to read records and then send them outward in one autonomous chain. The dangerous capability is often the combination, and combinations are exactly what a reasoning actor discovers on its own.
• Put a control between intent and action for the consequential steps. For anything irreversible or high impact, the agent proposes and a deterministic check disposes. This is the hook pattern I keep coming back to in The Gate Was Built for a Human: a prose instruction is a nudge the model may ignore, and a hook is code that always fires. Least agency lives in the hook, not in the system prompt, because the system prompt is itself part of the attack surface the injection is trying to overwrite.
• Treat every input as hostile content, not trusted instruction. The agent cannot be trusted to tell data from directive, so the boundary has to be enforced outside the model. Sanitize, isolate, and label untrusted input before it reaches the context, and never let a tool description the agent reads become a tool behavior you did not author.

None of this replaces least privilege. You still scope the credential, and you should scope it tighter than ever, because a smaller surface is a smaller ceiling. The point is that scoping the credential is now necessary and badly insufficient. A perfectly scoped token in the hands of a hijacked agent is a valid key turning in a lock for an attacker who never had to pick it.

What to actually do with this

Start by re-reading your own agent deployments through the OWASP agentic list instead of your existing access matrix. For every agent, ask the least-agency questions, not the least-privilege ones. Not “what can this identity access,” but “what is the worst legitimate sequence of permitted actions this agent could be talked into,” and “where does a piece of content it ingests get to rewrite its goal.” Those two questions surface risk your access review structurally cannot see, because your access review was built to bound a human.

Then move the enforcement off the model and into deterministic control. The agent’s own reasoning is the thing under attack, so it cannot be the thing that decides whether an action is safe. Least agency is worth building precisely because it does not depend on the agent staying uncompromised. It assumes the goal can be hijacked and the tools can be poisoned, and it bounds the damage anyway, by constraining what any agent, compromised or not, is allowed to actually do.

We spent ten years teaching a generation of engineers that the credential was the control. It was, for a human. The moment the actor became a machine that reasons, reads hostile text as instruction, and acts at machine speed, the control quietly moved from the credential to the behavior, and most security programs have not followed it there yet. Least privilege was the right answer to the old question. Least agency is the answer to the one you are actually being asked now.

---

The credential is not the risk once you hand it to something that reasons. The behavior is, and the attack that unlocks it comes in the instructions, below the network. Scope the agency, not just the access.

I write about AI-assisted development, enterprise architecture, and security in regulated environments. Find me on X @orestesgarcia or LinkedIn /in/setsero.