---
title: "Give each key the least power · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/least-privilege-keys
updated: 2026-10-20
licence: "All rights reserved"
---

# Give each key the least power

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)
- Rule: Give every key, account and service only the access it needs. Replace keys at least every 90 days, and at once after a leak or when someone with access leaves.
- How: Use a separate key for each service and each environment. Let the website's database user read and write its own tables, but not drop them or create users. Write down how to replace each key, and practise it. Let the secrets store do it on a timer, as [rotate secrets automatically](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/automatic-secret-rotation) says. For more depth, see [a service user](https://agentwranglers.se/playbook/operations/running-the-service/service-user) and [a sandbox](https://agentwranglers.se/playbook/operations/running-the-service/service-sandbox). Give the server a backup key that can write new backups but never delete them, so an attacker on the server cannot remove them. See [off-site backups](https://agentwranglers.se/playbook/operations/disaster-recovery/off-site-backups). See also [keep no long-lived access keys](https://agentwranglers.se/playbook/infrastructure/identity-and-access/no-long-lived-keys).
- Check: The agent uses the app's own database account to try a forbidden action, such as creating a table. The database refuses it. Every key in the secret store was created or replaced less than 90 days ago.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/least-privilege-keys`.

- Previous: [Encrypt data on the wire and on disk](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/encrypt-data)
- Next: [Keep storage buckets private](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-storage-buckets)
- [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)