Least privilege for AI agents, in practice
Least privilege is old advice that most agent deployments ignore, because the easy way to wire an agent to a database is to give it a connection string with everything. Here is how to not do that, in the specific terms that come up.
Connect with a service identity, act as a person
The connection to a system is a service identity — one credential per connected system per workspace, stored once, never shown to the model. But the authorization for each action is the person’s: their role, their group, their row scope. The service identity is how the plumbing reaches the system; the person is why it is allowed to.
Row scope, enforced below the agent
If an operations person may only see customers assigned to them, that limit must hold for every query the agent composes, including the clever ones. The reliable place to enforce it is the data layer — a scoped view, or row-level security in the database — so that a wider query simply returns less rather than relying on the agent to have asked narrowly.
Environments are separate permissions
Staging and production are different systems with different rules, and a policy should say so: retry in staging outright, retry in production with approval. An agent that treats them as one environment with a flag is one flag away from an incident.
Cap what a policy can do in a day
A permission with no rate is a permission to run away. A daily cap per policy — this team may propose at most so many production retries a day — bounds the blast radius of a bad afternoon, a compromised account, or a model in a loop.
Read-only connections are real, or they are not
A connector that is supposed to be read-only should be proven read-only against the actual engine — a write attempt refused by the database, not by a string check in the application. GlowForm’s database connectors ship with that proof per engine, because a read-only credential that isn’t is worse than none.
Withhold by default, grant by name
Every capability an agent has should be one an admin turned on, for a named group, with a named scope. If a capability exists in the product but nobody granted it, the agent should not have it. That is the whole of least privilege, and it is mostly a matter of defaults.