LLMs, GenAI, RAG, agents, evaluation · insight-0654
Let tools act with the requesting user's permissions, not a shared superuser account
- Evidence type
- documented fact
- Difficulty
- medium
- Roles
- ML engineer, Applied AI
- Industries
- saas, healthcare
Summary: situation, action, reason, boundary
Situation
All agent tools connect to backends with one service account that can read and write everything.
Action
Execute tool calls with credentials scoped to the authenticated user (delegated tokens with minimal scopes), keep tokens in application code rather than the prompt, and log calls under both user and agent identity.
Reason
Least privilege limits the blast radius of a successful injection to what the user could already do. OWASP recommends executing extensions in the user's context with limited scopes and handling privileged functions with app-held tokens.
Boundary
Enterprise assistants over email, documents, CRM or ticketing systems.
Symptom or risk
Any user who steers the agent, directly or through injected content, inherits the service account's full access.
Exceptions
Batch jobs with no end user; give them a dedicated, narrowly scoped identity instead.
Trade-offs
Delegated auth adds token management and consent flows.
Pitfalls
Scoping reads correctly but leaving write scopes broad "for later features".
Lessons and concepts
Claims and their sources
OWASP's Excessive Agency entry recommends least privilege and executing extensions in the user's context with minimal scopes rather than with a generic high-privilege identity.
OWASP's Prompt Injection entry recommends handling extended functions in code with the application's own API tokens rather than giving them to the model.