# Least Privilege

Grant an agent, tool, or credential only the minimum access needed for its task — nothing more.

## Why the CCAR-P exam tests this

The exam tests whether you scope agent and tool permissions to the narrowest set that still does the job, limiting blast radius.

## Definition

**Least privilege** means every identity — a user, an agent, a service account, a tool integration — holds only the permissions required for its specific function, and no broader. A summarization agent gets read access to the one collection it summarizes, not admin on the whole database.

For LLM systems this is the primary limiter of **blast radius** when a prompt injection or model error slips through. If an agent can only read a scoped resource, a compromised prompt cannot make it delete records or exfiltrate other tenants' data — the capability simply isn't granted. Scope tokens tightly, prefer read-only where writes aren't needed, separate credentials per tool, and expire/rotate them.

Least privilege pairs with **fail-closed** (default deny, grant explicitly) and with **tool-call authorization** (the runtime check that a specific action is within the granted scope). It is a *standing* property of how access is provisioned, complementing the *per-request* escalation and authorization checks.

## Exam trap

Giving an agent a broad admin key "for convenience" or "so we don't have to change it later" is the trap — over-provisioning turns any single injection into a full compromise.

## Commonly confused with

- **fail-closed-vs-fail-open** — Least-privilege limits what is granted; fail-closed decides behavior when a check errors — both default to deny.
- **guardrail-placement** — Least-privilege scopes the permission; tool-call authorization (a guardrail) enforces it at runtime.

## Related

- guardrail-placement
- fail-closed-vs-fail-open
- prompt-injection-defense
- compliance-control-register

---

Source: Claude Cert Prep — an independent, unofficial CCAR-P study resource (domain P5). Not affiliated with Anthropic.