---
title: "Give agents the fewest rights they need · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/least-privilege-agents
id: AID-26
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 813
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Give agents the fewest rights they need

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-26
- Level: Required
- Chapter: [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)
- Rule: Give each agent token only the rights its task needs, and make it short-lived and easy to revoke.
- Check: With the agent's token, try to merge to the main branch, delete the repository and read another repository. All three fail. The token shows an expiry date.
- Risk: An account or system taken over
- How: Use fine-grained tokens, such as a repository-scoped token that can push branches but not merge or change settings. Set each token to expire, such as within 30 days. Use read-only database users for analysis. See [give agent tools the least power they need](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/least-privilege-tools.md).

## Sources

- [OWASP LLM03:2026 Excessive Agency](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM03_ExcessiveAgency.md)

## Related rules

- APS-85 [Give agent tools the least power they need](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/least-privilege-tools.md) in Application security
- AID-77 [Give each subagent only the tools its job needs](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/subagent-tool-limits.md) in AI-assisted development
- AID-72 [Keep publishing rights away from agents](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/no-publish-rights-for-agents.md) in AI-assisted development
- AID-74 [Allow only listed MCP servers and pin each one to an exact version](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-server-allow-list.md) in AI-assisted development
- AID-58 [Ask before a skill changes data or spends money](https://agentwranglers.se/playbook/ai-assisted-development/agent-skills/skill-asks-first.md) in AI-assisted development

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/least-privilege-agents">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep production credentials away from agents](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/no-production-credentials.md)
- Next: [Give each subagent only the tools its job needs](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/subagent-tool-limits.md)
- [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)