Agent WranglersSafety and permissions Required
Give agents the fewest rights they need
Give each agent token only the rights its task needs, and make it short-lived and easy to revoke.
How to do it
Use fine-grained tokens, such as a repository-scoped token that can push branches but not merge or change settings. Set each token to expire, such as within 30 days. Use read-only database users for analysis. See give agent tools the least power they need.
How to check
With the agent's token, try to merge to the main branch, delete the repository and read another repository. All three fail. The token shows an expiry date.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/least-privilege-agents.