Grant each agent only the permissions it needs for its specific task — and nothing more. An email summarization agent should be able to read emails, not send them, not access the file system, not call external APIs. A customer support agent should be able to query order status, not list all customer records. Scope permissions per task, not per agent type.
Treat agents as first-class identities with their own scoped credentials — not as extensions of the user's full access. If the agent is compromised, its blast radius is bounded by what it was allowed to do.
Implement separate read/write scopes for each data source the agent can access. Use short-lived, task-scoped tokens rather than long-lived credentials. Revoke access when the task completes. Audit permission grants regularly — agents tend to accumulate access over time as new tasks are added without old permissions being removed.
Least privilege limits blast radius — it does not prevent hijack. EchoLeak succeeded because Copilot had read access to the entire mailbox, not because it had write access. A read-only agent can still exfiltrate everything it can read. Least privilege must be paired with exfiltration controls and behavioral monitoring.
A hijacked agent can only do what it was allowed to do. The smaller that set, the smaller the catastrophe.
Ask your team: what is the worst thing your AI agent could do if it were compromised — and does it actually need the access required to do that? If the agent handles customer data but could also delete it, ask why delete access is granted at all.