Topic
The security practice of granting a process or credential only the capabilities it needs, instead of broad access that happens to cover them.
Apple announced on October 2 that macOS Full Disk Access can be granted only through very explicit user action, citing the added risk from AI agents. Agent builders can scope to user-selected folders now.
Reality
Spain's AEPD disclosed its first breach notice naming an AI agent as the reported attacker, based on an account the regulator has not verified. Read with cases in Australia and a coding-agent test, it puts the cost for insurers and security teams in the permissions each agent holds.
Reality
Schemity's developer showed that a PostgreSQL role with only CONNECT and USAGE reads the full schema from pg_catalog while every table SELECT fails. Diagram tools built on information_schema show that same role an empty database.
Reality
Pillar Security CEO Ziv Karliner says OpenAI's sandbox escape shows AI agent limits must be enforced outside the model. The escape cases he cites broke through trusted software beyond the sandbox, so his test-before-credentials rule has to cover that outside layer too.
Reality
Between March and April 2025 intruders searched an industrial automation firm for "customers" and "SCADA", then bundled about 800 files. FBI and CISA now want least privilege applied to integrator access.
Reality
A dev.to post argues that real-time supervision of a swarm is not available and the work of oversight becomes prevention by construction. All four of its requirements have to be enforced at the tool call every sub-agent shares.
Reality
Permission-by-permission review scores iam:PassRole, lambda:CreateFunction and lambda:InvokeFunction as controlled access, while path analysis sees one route to whatever the passed role holds. Three policy layers decide whether that route is live.
Reality
A dev.to walkthrough pins the first pass of a least-privilege review on four questions the API server already answers, and it puts create pods above get secrets in the escalation order. Aggregated roles decide how far that pass gets.
Reality
A dev.to post argues that the standing-key setup most people use for agents is a credential problem, and its three prescriptions of short-lived scoped tokens, per-tool grants and human confirmation on irreversible actions each carry an adoption cost.
Reality
Chris Romeo says he cannot start a Claude sub-agent with a permission set narrower than its parent's. Jacob Krell says each delegation step creates an identity that IAM systems were never built to track.
Reality
A dev.to post gathers three agent incidents from 2025 and 2026 behind one rule about granting connectors only the scope their task needs. Two of the three failed inside the target API's own authorization.
Reality
Two months of AWS audit logs from 125 environments went through UMAP and HDBSCAN to group more than 40,000 identities by what they actually did, and the classification rules that fell out run in plain SQL.
Reality
A dev.to walkthrough rotates a production API key with two scoped credentials, an explicit activation step, and a revoke that waits for the old key's telemetry. The design assumes a provider that can scope, report and revoke.
Reality
A dev.to post puts the containment work in the token itself, giving each CI job one audience, one action set and one expiry. It comes with a drill an engineer can run on a disposable key without production access.
Reality
Landlock has been in mainline Linux since 5.13 and asks no administrator for permission. The dev.to walkthrough that demonstrates it prints a read-only rule under a goal that requires writing.
Reality
Neeraj Sabharwal's Forbes Tech Council argument separates prompt injection, tool scope, rollback and runtime monitoring from the policy work boards already fund, and it arrives without a single incidence figure.
Reality
Hossein Hezami's ladder runs observe to destroy and gives sensitive reads a class of their own. The interesting part is the TypeScript, where risk arrives as a field on the request and someone other than the model has to set it.
Reality
Permission rules accumulate from "yes, don't ask again" answers into a repo-local file, and because matching runs deny then ask then allow with no specificity tiebreak, a policy that reads correctly can still stall an unattended run.
Reality