---
title: "Give agent tools the least power they need · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/ai-features-and-agents/least-privilege-tools
id: APS-85
level: Required
applies: ai-features
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 658
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Give agent tools the least power they need

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [AI features and agents](https://agentwranglers.se/playbook/application-security/ai-features-and-agents.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-85
- Level: Required
- Chapter: [AI features and agents](https://agentwranglers.se/playbook/application-security/ai-features-and-agents.md)
- Rule: Give the model only the tools its task needs, each with the narrowest rights, acting as the user and never as an administrator.
- Check: Ask the assistant to call each tool it has with another user's record. Every call fails with the same error the normal API gives.
- Risk: Data leaked or lost
- Applies when: The project uses AI models.
- How: List the tools per feature. A help chat needs to read orders, not refund them. Run every tool call with the user's own rights, so the server checks them as it would for the user. Use read-only database accounts where reading is enough.

## Sources

- [OWASP LLM03:2026 Excessive Agency](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM03_ExcessiveAgency.md)

## Related rules

- AID-26 [Give agents the fewest rights they need](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/least-privilege-agents.md) in AI-assisted development
- AIF-15 [Design tools like a small public API](https://agentwranglers.se/playbook/ai-features/structured-output-and-tools/tool-design.md) in AI features
- AIF-73 [Connect product agents only to tools and servers on a reviewed list](https://agentwranglers.se/playbook/ai-features/agents-in-products/reviewed-agent-tools.md) in AI features

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/ai-features-and-agents/least-privilege-tools">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Break the lethal trifecta](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/lethal-trifecta.md)
- Next: [Treat model output as untrusted](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/untrusted-model-output.md)
- [AI features and agents](https://agentwranglers.se/playbook/application-security/ai-features-and-agents.md)