Privilege Boundaries — What the Model Can and Can't Do

~14 min · security, privilege

Level 0Apprentice

0 XP0/100 lessons0/14 achievements

0/120 XP to next level120 XP to go0% complete

Least privilege as a prompt principle

An agent's blast radius is the set of things its tools can do. Reduce that set to the minimum the task needs. "This support agent can search orders, escalate to humans, and write notes" is much narrower than "this agent can do everything our internal API supports."

Levels of privilege

Read-only — search, list, fetch. Cannot mutate.
Self-mutating — can change its own state (drafts, notes) but not external state.
External-mutating — can write to systems of record. Requires confirmation patterns.
External-actioning — can send email, charge cards, call APIs with side effects. Highest scrutiny.

Per-user scoping

Tools should accept a user_id (or scope token) and enforce ownership at the data layer. The model can't be trusted to enforce "only show this user's orders" — the tool must.

Code

Per-user scoped tool·python

@tool
def search_orders(customer_id: str, *, _ctx) -> list[dict]:
    # _ctx is injected by the agent runtime
    if customer_id != _ctx.authenticated_user_id and not _ctx.is_admin:
        raise PermissionError("agent cannot access other users' orders")
    return db.orders.find(customer_id)

External links

Exercise

Audit one agent's tool set. Reclassify each tool as read-only / self-mutating / external-mutating / external-actioning. Identify any tool that's broader than the task needs.

Progress

Progress is local-only — sign in to sync across devices.

← PreviousOutput Filtering — Don't Trust the Model's Words Next →Untrusted Content Tags — XML, JSON, Markdown

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.