Least Agency

Sources#

• Claude Opus 5 System Card
• The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities
• Zero Trust for AI Agents

Summary#

Least agency is a term coined by OWASP that extends the classic least-privilege principle to agentic applications. Where least privilege constrains what users and systems can access, least agency goes further: it restricts what each agent tool can do, how often, and where. It is the authorization principle at the center of Zero Trust for AI Agents — the practical answer to "even a perfectly authenticated agent causes damage when granted excessive permissions."

The distinction from least privilege#

Traditional least privilege is about access scope (which resources an identity can touch). Least agency adds the action and frequency dimensions that matter once an identity can autonomously chain operations:

• a database tool gets read-only queries (not write/delete)
• an email summarizer gets no send/delete rights
• an API integration gets minimal CRUD operations

The shift matters because an agent operates within its granted permissions while still being manipulable into misusing them — the tool-misuse and tool-chaining threats that traditional access controls can't prevent (see Agentic Prompt Injection and Agent Supply Chain Risk for the attack side). Least agency shrinks the set of harmful actions reachable even with valid credentials.

How the framework enforces it#

Least agency is enforced through the access-control tier ladder and Phase 3/5 of the implementation workflow:

• Deny-by-default — block all access not explicitly granted; treat it as a starting posture, not a destination.
• Permission models — RBAC (Foundation) → ABAC with context-aware policies (Enterprise) → continuous authorization re-evaluated per action (Advanced).
• Privilege scoping — static least-privilege roles (Foundation) → dynamic elevation per task with return-to-baseline (Enterprise) → JIT/JEA with automatic expiration (Advanced). "When in doubt, prefer a control that removes a capability over one that throttles it."
• Capability restrictions — an email tool restricted to reading, with send requiring separate authorization; a database tool that queries but can't change schema.
• Compartmentalization — splitting an agent's functions across multiple agents, each with its own unique identity and credentials, so attackers must compromise several agents to reach more resources. "If you break it into multiple agents and provide them all the same credentials, you have failed to compartmentalize the risk."

Relation to blast radius#

Least agency is the input control; Blast Radius (Agentic) is the outcome metric. Constraining agency (actions × frequency × scope) is precisely how you shrink the blast radius an "assume breach" posture expects to be tested. The two are read together: scope an agent's account to read-only on exactly the data it needs, and a stolen credential's blast radius is "severely limited."

Connections#

• Instruction Compounding — least agency as the surviving instruction class: on a model where requests for behavior backfire, the stay-in-scope constraint ("deliver what was asked… stop short of actions clearly beyond what was asked") is what still works, and it is this principle written as a prompt

• Unproductive Self-Verification — the principle violated from the inside: asked only to explain, Opus 5 fixed a bug, added six tests and patched two docstrings; the episode was not rewarded

• Zero Trust for AI Agents — the framework that adopts least agency as its authorization principle (hub)

• Blast Radius (Agentic) — least agency is how you constrain it; agency-in, blast-radius-out

• Agent Identity and Authentication — least agency is unenforceable without distinct per-agent identity (the "attribution gap" makes enforcement impossible)

• OWASP — coined the term

• Claude Code Best Practices — Claude Code's deny-by-default permissions and write-access restrictions are the cited reference implementation

• Agentic Prompt Injection — the attack that least agency contains: manipulated agents misusing tools within authorized privileges

• Impossible, Not Tedious (Design Test) — "prefer removing a capability over throttling it" is least agency expressed as a design heuristic

• MCP and Computer Use — capability restrictions per MCP tool (read-only, no-send) are least agency at the tool-interface level

• Autonomous Defense — least agency applied inward on defensive agents: scoped automated-response actions with clear boundaries

• Agent Supply Chain Risk — scoping what a (possibly poisoned) tool can do limits the damage a compromised dependency can cause

• Out-of-Band Prompt-Injection Defense — Progent enforces least agency deterministically at the tool-call boundary (symbolic per-call privilege rules); the reference monitor is the mechanism that makes "restrict what each tool can do" a hard barrier rather than a prompt advisory. That page also carries the counterexample to this page's premise: Rehberger's macOS Terminal chain (case-study, patched Nov 2025) exfiltrates spreadsheet rows through an OSC 7 escape sequence the model prints to stdout, which the terminal resolved as a DNS lookup. The agent invoked no tool, so it needed no agency — a rendered output stream is an egress channel that exists at zero granted agency, and "restrict what each tool can do" bounds none of it. One PoC on a demo CLI, and the fix landed at the renderer, not the gate. It also now carries the cost side of this page's premise, measured: APPA (Archestra AI, arXiv 2607.24625, empirical) enforces least privilege at trajectory granularity — permissions descend monotonically over a finite lattice and never widen, which is deny-by-default proven rather than configured — and its whole motivation is that this is exactly what makes least agency expensive. One restrictive read permanently lowers the label and revokes downstream tools for the rest of the task ("label creep"), so an agent that has done nothing wrong ends up unable to finish. Their fix is to make the restriction scoped rather than sticky (confine it to a disposable child trajectory), recovering utility from 28→44%, 54→72% and 69→95% across three of four models with attack success unchanged. The generalizable lesson for this page: the cost of least agency is not the tightness of the scope but its permanence, and those are separable

• Agent Data Injection (ADI) — the limit of least agency as a defense: Progent (least agency at the tool-call boundary) cuts ADI to 22.2% but can't eliminate it, because scoping what a tool can do doesn't help when the attack forges the data the agent legitimately acts on within an already-authorized action

• Task-Specification Effects in Prompt Injection (AutoDojo) — least agency as the winning answer: AutoDojo (Ma et al. 2026) finds action-constraining system-level defenses (Progent, DRIFT) are the only family that holds under a cheap adaptive attack, and they grow stronger on under-specified action-open tasks (a read-only request yields a trajectory permitting no write, so any injected write is blocked regardless of phrasing) — "real robustness comes from binding actions to the user's request, not filtering inputs"

• Capability Gating Is Not Authorization — least agency at argument-value granularity: capability gating scopes which tools an agent holds; ScopeGate's authz stage scopes which argument values each call may carry, deterministically enforced at the tool-call boundary. Mellafe Zuvic (2026) audits LangChain/LlamaIndex/Stripe and finds they ship the capability gate but not this value gate by default — so a manipulated agent acts within its granted capability but on unauthorized values (the confused deputy least agency is meant to contain). The axis this page does not reach at all: Rashidi's execution-security SoK (The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities, empirical) names "permitted, but not intended now" as a recurring root cause and its Gap 5 as unaddressed by any enforcement mechanism in a 39-paper corpus — an agent taking a benign, unrequested action using a capability it legitimately holds is neither a permission failure nor a value-authorization failure, so neither "what each tool can do, how often, and where" nor an argument allowlist forbids it. OverEagerBench measures Claude Code's rate of exactly this swinging 0.0% → 17.1% on prompt phrasing alone (Qu et al., arXiv 2605.18583, restated by the survey, not replicated by it). Least agency's three dimensions — action, frequency, location — are all defined over what is permitted; none is defined over what was asked for

• Off-Host, Identity-Bound Authorization — the same argument-value least agency, moved off-host and re-anchored to the verified human on every call: aiAuthZ (Kodathala, arXiv 2607.05518) evaluates a role + path/URL/recipient + rate policy the agent can't read or rewrite, and binds each tool call's authority to the most-recently-verified human message — the direct answer to the elevation-path open question below (bind the elevation to cryptographic identity, not agent-asserted text)

• MCP Tool Poisoning — the containment case for a detection-proof delivery: ShareLock reconstructs a hidden instruction at runtime that no scanner can catch, but the reconstructed action (read api_key, reach an unlisted egress) still runs within granted capability — scoping the filesystem tool to no-egress / no-api_key-read bounds the damage regardless of how the payload was smuggled past vetting. Its Agentjacking case study is the real-world version: the hijacked agent runs a fake-diagnostic npx package and exfiltrates env vars / cloud creds — all within the shell and network agency a coding agent is normally granted, so least-agency scoping (no arbitrary package execution, no unlisted egress) is one of the few controls that would have bounded it (vendor-reported, weighted below the empirical framework)

• Agent Identity Management System (AIMS) — AIMS enforces least agency at the standards layer: OAuth minimal scopes + audience restriction, and transaction tokens that downscope a broad access token to a single non-reusable transaction along the microservice call chain; that page also carries the OpenID AuthZEN COAZ draft — least agency at the tool-invocation point, exposing "the authorization checks required to call a tool" so a PDP authorizes each MCP invocation (a proposed Working Group Draft)

• Non-Malleable Memory Authority (TMA-NM) — least agency as separation of duty on agent memory: TMA-NM's corroboration-gated elevation refuses to let any untrusted-sourced consequential action execute on a single principal's say-so, requiring ≥2 independent trusted endorsements (or a fresh action-bound user authorization); the threshold k scales with an action's blast radius as a per-action deployment knob

• Foundation → Enterprise → Advanced: Is the Agent Access-Control Jump a Cliff? — where the RBAC→ABAC→continuous-authorization and static→dynamic→JIT ladders sit; the Enterprise midpoint and the ABAC-tier-placement contradiction

• Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox — resolves this page's frequency paradox: "how often" is friction when enforced as a resettable rate, a barrier when enforced as authorization-bound cardinality (single-use nonces, transaction tokens, expiring credentials, fail-closed idempotency caps)

• Write-Then-Trusted — a second counterexample to this page's premise, structurally unlike the OSC 7 one above. In Pillar Security's eight cross-vendor sandbox escapes (case-study, CVE-2026-48124 / GHSA-v4xv-rqh3-w9mc / GHSA-p9g2-cr55-cw9c) the agent uses only tools it is fully authorized to use — it writes a file inside its workspace — and the escape happens afterwards, in a different, unsandboxed process that runs, loads, or scans that file. Least agency prices the agent's actions; nothing here prices what a host component does with the artifact a permitted action produced. Its GitPwned finding also shows the enforcement granularity failing in the other direction: an allowlist that trusted git by name rather than by invocation was RCE (patched Codex CLI v0.95.0)

• Self-Propagating Prompt Injection (AI Worms) — a third counterexample, and the starkest: there is no over-privileged call to deny anywhere in the chain. In Måløy's Copilot for Word disclosure (case-study, MSRC, 144-day coordination) the user asks Copilot to draft a document and Copilot drafts that document — the harmful act is the authorised act, differing from the intended one only in content. No unexpected tool, no unexpected sink, no argument a per-call policy could reject, and no rate or scope limit that binds. Agency-scoping prices actions; this attack spends only the ones the user already bought, then rides the output into the next session

Open Questions#

• Dynamic privilege elevation (Enterprise) reintroduces an elevation path; how is the elevation request itself authenticated against a manipulated agent? Partially answered: aiAuthZ (Kodathala, arXiv 2607.05518) moves the decision off-host and binds a tool call's authority to a per-message HMAC-signed human turn, not to what the agent asserts — so "the message body can claim anything, including that an owner approved the action, but the bound identity is cryptographic and the claim confers nothing." Measured: it blocks the 5 identity-spoofing cases (a non-owner claiming owner authority) that an argument-only policy can't distinguish from legitimate owner use (9/9 vs 4/9). The residual it does not close: an elevation firing under the active owner's own authority — bounded only by argument/rate policy, the same corrupt-legitimately-variable-data limit every value gate shares. Caveat: a single-author preprint.

Resolved Questions#

• Least agency adds a frequency dimension ("how often"), but the framework also says rate limits are friction, not barriers (Impossible, Not Tedious (Design Test)). How is frequency-limiting both a least-agency control and a friction-only one — context-dependent? Answered: Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox — the paradox dissolves on mechanism, not context: a resettable rate (N-per-minute throttle) is friction an unlimited-patience attacker outwaits, while a cardinality bound tied to an out-of-band authorization event (AIMS transaction tokens with frequency = 1, aiAuthZ single-use nonces, ScopeGate's fail-closed idempotency/ceiling stages, the framework's own expiring tokens — "the window closes, not just narrows") is capability removal: the (N+1)th action is unauthorized, not slower. Frequency-limiting is a barrier exactly when the counter lives outside the agent's trust domain, exhaustion denies rather than delays, and the reset is a fresh authorization event rather than the passage of time.

Sources#

• The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities — Mohammadreza Rashidi, arXiv 2607.05743, 2026-07-07, empirical. §5.1 (RC3, "permitted but not intended now") and §6.5 (Gap 5 — scope creep measured but addressed by no access-control or capability mechanism in the corpus). A systematization: the 0.0%→17.1% figure is OverEagerBench's (Qu et al., arXiv 2605.18583), restated and not replicated. Full treatment on Capability Gating Is Not Authorization
• Zero Trust for AI Agents — least agency defined in Part I; enforced across Part III access-control tiers and Part IV Phases 3 & 5