LANDMARK · 7 MIN · BUILD
Permissions and least privilege
After this landmark, you can design an agent’s access so a manipulated or mistaken action is limited by what it’s able to touch, not by what it’s told not to touch.
You can still explore it. We’re showing the shared explanation and a related practical view without hiding the knowledge.
Least privilege (granting only the access a task strictly needs, nothing ‘just in case’) is the single most reliable control on agentic systems, because it holds even when every other control fails: even if the model is jailbroken, injected with malicious instructions, or simply wrong, it cannot exceed the access it was actually granted.
A prompt instruction telling a model not to do something is a suggestion the model might not follow; a permission it was never given is a wall. Design agent access the way you’d design any privileged system’s, narrow, revocable, and scoped to the specific task, not the account.
This is the canonical concept. It stays the same across learner lenses so personalization never changes the underlying facts.
What this looks like for you
Before connecting an assistant to your email, calendar, or files, check what access it’s requesting; read-only where you can, and only the accounts it actually needs, not everything at once.
MAKE A DECISION
You’re setting up an agent to triage support tickets by reading them and suggesting a category. What access should it have?
CARRY THISCheck one AI tool’s connected-account permissions (email, calendar, files, or a work tool). Is any granted access broader than the tool’s actual job?