“Base access decisions on permission rather than exclusion.”Jerome H. Saltzer, Michael D. Schroeder · The Protection of Information in Computer Systems · 1975 · The Protection of Information in Computer Systems, Proceedings of the IEEE 63(9), septembrie 1975 — §I.A.3, principiul «fail-safe defaults»
An identity of its own for the agent, allowlisted rights, a sandbox and approval on the irreversible.
The OWASP Top 10 for agentic applications (2025–2026) names the risks: goal hijacking, tool misuse, identity and privilege abuse, the supply chain, code execution, memory poisoning, cascading failures, insufficient monitoring. The controls: an identity of its own per agent (not the user's full token); narrowly scoped, short-lived credentials; read separated from write; sandboxed execution (container, no network by default, ephemeral file system); tools on an allowlist per task; approval on irreversible actions (payments, deletions, sends); rate and spend limits; a kill switch. Surveys in 2026 show about half of organisations with an agent permissions incident. The design question: "what is the worst this agent can do with what it holds?" — the answer should be boring.
Why it matters A compromised agent does exactly what it can do; least privilege is how much that "exactly" matters.