Taking a least privilege mindset to MCP
Does your agent really need access to
every tool call under the sun?
You can't just tell an agent, "Don't touch production."
We've already seen plenty of examples of what happens when AI agents accidentally have too many privileges: deleted databases, destructive code commits, business disruption, and more.
And industry reports and case studies demonstrate that agents are routinely overprivileged, with a growing visibility gap around what they can actually access. Call it what you want: multi-agent privilege drift, permission sprawl, shadow MCP servers.
One important guardrail is least privilege.
My latest for the Zuplo blog makes the case for applying least privilege to agentic tool calls:
The reason? Agents are tenacious. They'll use or try whatever tools and means are at their disposal to unblock themselves. Sometimes that goes haywire.
But, of course, we can't take away all the "autonomy" from agents. Otherwise, they wouldn't be that "autonomous," would they? 😉
The answer is somewhere in the middle: carefully curating what you expose and making smart access decisions in the moment.
Other Blog Posts
