Least Privilege
A basic principle in the security field whereby any principal should possess only the minimum privileges necessary to complete its task, and those privileges should remain valid only for the shortest necessary period. When applied to AI agents, it must be combined with dynamic authorization.
Core Facts
Timeline (last 90 days)
缩小爆炸半径的常见手段包括权限最小化、凭证隔离和短生命周期。
Routine operations should not directly hold cluster-admin privileges; temporary on-demand privilege escalation, revoked immediately after use, can downgrade 'one token compromised equals total compromise' to a localized impact.
Least privilege, action confirmation mechanisms, and rollback-capable sandbox environments are three unavoidable requirements in the design of computer-operating AI agent systems.
Least privilege requires each tool to use an independent, scope-limited credential rather than one broad OAuth token covering all services, because once the latter leaks, the attack surface equals the entire set of integrations.
The author proposes three lessons: start with the narrowest permission that supports the entry point, let the backend handle as little data as possible, and list the things you cannot do to build trust.
开发者应默认拒绝而非默认允许代理的权限，行为日志应按审计标准设计，熔断机制需在架构层预留。
AI Agent policy testing typically needs to cover three key layers: Intent, Role-Based Access Control (RBAC), and Approvals.
All Facts (7)
AI Agent policy testing typically needs to cover three key layers: Intent, Role-Based Access Control (RBAC), and Approvals.
75%Unverified缩小爆炸半径的常见手段包括权限最小化、凭证隔离和短生命周期。
50%UnverifiedRoutine operations should not directly hold cluster-admin privileges; temporary on-demand privilege escalation, revoked immediately after use, can downgrade 'one token compromised equals total compromise' to a localized impact.
50%UnverifiedLeast privilege, action confirmation mechanisms, and rollback-capable sandbox environments are three unavoidable requirements in the design of computer-operating AI agent systems.
50%UnverifiedLeast privilege requires each tool to use an independent, scope-limited credential rather than one broad OAuth token covering all services, because once the latter leaks, the attack surface equals the entire set of integrations.
50%UnverifiedThe author proposes three lessons: start with the narrowest permission that supports the entry point, let the backend handle as little data as possible, and list the things you cannot do to build trust.
50%Unverified开发者应默认拒绝而非默认允许代理的权限，行为日志应按审计标准设计，熔断机制需在架构层预留。
50%