Least Privilege
Also: principle of least privilege · PoLP · minimal scope · need-to-know
Grant an agent, tool, or credential only the minimum access needed for its task — nothing more.
Why CCAR-P tests this
The exam tests whether you scope agent and tool permissions to the narrowest set that still does the job, limiting blast radius.
Least privilege means every identity — a user, an agent, a service account, a tool integration — holds only the permissions required for its specific function, and no broader. A summarization agent gets read access to the one collection it summarizes, not admin on the whole database.
For LLM systems this is the primary limiter of blast radius when a prompt injection or model error slips through. If an agent can only read a scoped resource, a compromised prompt cannot make it delete records or exfiltrate other tenants' data — the capability simply isn't granted. Scope tokens tightly, prefer read-only where writes aren't needed, separate credentials per tool, and expire/rotate them.
Least privilege pairs with fail-closed (default deny, grant explicitly) and with tool-call authorization (the runtime check that a specific action is within the granted scope). It is a standing property of how access is provisioned, complementing the per-request escalation and authorization checks.
Exam trap
Giving an agent a broad admin key "for convenience" or "so we don't have to change it later" is the trap — over-provisioning turns any single injection into a full compromise.
Commonly confused with
Related concepts
Independent, unofficial study material from Claude Cert Prep. Not affiliated with Anthropic.