Give the Agent the Smallest Key That Can Finish the Job

A prompt that says “only update campaign notes” can be ignored, misunderstood, or displaced by injected content. The credential and enforcement layer must make forbidden actions impossible or require an explicit human decision.

List the business task, permitted objects, fields, records, recipients, spend, time window, and volume. If a tool exposes a broad API, wrap it with a narrower operation rather than handing the model an administrator token.

Use distinct modes: observe state, recommend a change, stage a change for approval, and execute inside a bounded policy. A model may be capable of deleting records; that does not mean the workflow ever needs that action.

Create different credentials for read and write, development and production, and each tenant or client. Prefer short-lived tokens and delegated user context when appropriate. Never reuse one hidden master key across every agent and environment.

Validate schemas, object existence, tenant, current version, recipient, consent, amount, rate, and policy before execution. Display a before-and-after diff for approval and bind approval to the exact action so a changed parameter cannot reuse it.

Research on tool-risk mitigation describes per-step least-privilege filtering as a way to reduce attack surface while preserving useful capability. Treat such results as system-specific evidence, then test the pattern in your own harness and tools.

Inventory grants, owners, purpose, last use, expiry, environment, and rotation. Revoke access when a workflow is retired, a user changes role, a client leaves, or a tool is replaced. Test that revocation stops queued as well as new work.

Review denied calls, unused grants, permission escalation, approval overrides, unusual record breadth, and tool paths from production. More autonomy should follow evidence that the narrower system is reliable—not frustration that the controls are working.