Tag
作者分享为生产环境中执行分析和调试任务的 AI 代理设计数据库访问控制的经验：为每次查询签发可过期的单次权限，并在使用时重新校验，同时指出设计中仍存在的缺口，最后向社区征求其他方案。
AI agents from Tencent and Indian agencies reportedly escaped their intended scope and accessed live systems undetected, underscoring that the hard part of agent building is boring operational security: scoping tool calls, least-privilege credentials, comprehensive logging, and sandboxed testing.
The post advises against giving AI agents full write access to websites, recommending instead narrow single-purpose tools, a single source of truth, mandatory diffs before publishing, and separating form data from site hosting to avoid losing leads during rollbacks.
Josh King (CTO at &above) argues AI agent identity is really two separate questions — whether the identity is borrowed from a human or native to the agent, and how broadly that identity is scoped — and critiques recent moves by Okta, 1Password, WorkOS, and Anthropic's Claude Tag for largely ignoring least-privilege scoping.
A practitioner reflects on how the 'blast radius' of an internal AI agent — its over-broad database roles, trusted internal API tokens, and environment-stored secrets — matters more than defending against prompt injection itself, and asks the community how they scope agent tool access and secrets without crippling usefulness.
This post argues that written AI governance policy rarely becomes a hard runtime boundary — an agent's actual blast radius is determined by its credentials, not its prompts. It cites a Delinea survey where 99.7% of organizations had formal AI access policy, yet 87% reported an AI tool or agent reached sensitive data it shouldn't have, and discusses how the enforcement gap widens with subagents.
一篇基于论坛讨论的经验帖，总结了 AI agent 上线前的权限审查清单：给 agent 独立身份、按实际凭证核对可访问范围、严格分离读写权限、用拒绝性问题测试过度授权，以及检查撤销权限后缓存答案是否仍然泄露。
The article argues that AI agent safety should be addressed as an access-control problem, recommending practices like least privilege, allow-lists, and approval gates to prevent unintended actions.
Cloudflare proposes an Agent Access Model (AAM) to adapt Zero Trust security controls for AI agents, emphasizing task-scoped ephemeral access and least privilege.
As AI agents gain more capabilities, operational control—not model capability—becomes the primary challenge, raising critical questions about security, permissions, observability, and recovery.
This paper argues that applying content-safety refusal methods to AI agents is a category error—agentic harm lies in authority misuse rather than output—and proposes action alignment enforced outside the model via least privilege.
This paper investigates over-privileged tool selection in LLM agents, introducing ToolPrivBench to evaluate and mitigate unnecessary use of high-privilege tools. It finds that safety alignment does not ensure least-privilege choices, and proposes a post-training defense that reduces excessive privilege use without sacrificing performance.
This paper proposes Risk-Aware Causal Gating (RACG), a training-free mechanism that applies the principle of least privilege to LLM agent tool exposure, reducing attack surface from prompt injection by only exposing high-risk tools when authorized and causally necessary.
A blog post discussing techniques for dropping privileges in Go programs to enforce the principle of least privilege, including chroot and user switching.