https://t0ul.com/tags/least-privilege/Recent content in Least-Privilege on t0ulHugoen-usTue, 23 Dec 2025 00:00:00 +0000https://t0ul.com/blog/least-privilege/Tue, 23 Dec 2025 00:00:00 +0000https://t0ul.com/blog/least-privilege/<p><em>Part of my <a href="https://t0ul.com/blog/the-plan/">AI Security Engineering</a> series, a local email-to-calendar agent I build, then attack, then harden. If you have not set up the lab yet, start with <a href="https://t0ul.com/blog/setting-up-the-lab/">Set up your lab</a>. The lessons are <a href="https://github.com/t0ul/ai-security-engineering">on GitHub</a>, and the agent itself lives at <a href="https://github.com/t0ul/emaildrop">t0ul/emaildrop</a>.</em></p> <h2 id="what-a-tool-is-allowed-to-do">What a tool is allowed to do</h2> <p>The injection chapter was about what the model is told, and the secrets chapter about what the agent stores and emits. This chapter is about agency: what the agent is actually allowed to do. The agent is not one program, it is a set of tools the planner chooses between, one that summarizes, one that extracts events, one that writes the calendar file, and the safest way to run a set of tools is to assume any of them might be turned against you and make sure none of them can do more than its own narrow job.</p>