Least-Privilege Tools and Human Approval for Agents
How to give agents only the permissions they need and keep people in control of actions.
Agents are users too
An agent that calls tools acts on your systems. Give it its own identity, separate per customer tenant, with the narrowest permissions each task needs. A support agent that reads help articles does not need write access to billing.
Approval for consequential actions
Require a person to approve actions that send messages, move money, delete data or change access. Show the approver exactly what will happen and which data the agent used. Record who approved and when.
- Read-only tools by default.
- Write tools scoped to one tenant and one object type.
- Approval queue for external messages and payments.
- Short-lived tokens issued at the time of the call.
Keep secrets out of prompts
System prompts can leak, which is why OWASP lists System Prompt Leakage as LLM07. Never place API keys, passwords or internal URLs in prompts. Fetch credentials from a secrets manager inside the tool, not the model.
- Give each agent its own scoped identity.
- Require human approval for consequential actions.
- Keep credentials out of prompts.
List every tool one of your agents can call. Mark each read or write, and add an approval step to every write that reaches outside your system.
Check your understanding
1. What permissions should an agent have by default?
2. Which action should need human approval?
3. Where should API keys live?
From USD 49 or INR 2,999 a month. A person approves every step.