Least Privilege: The Property That Prevents, and the Evidence It Leaves

Least privilege is the third of the seven properties, and the only one that prevents rather than records. Across the six publicized agent incidents analyzed for this handbook, it breaks the attack chain in three (the GitHub MCP exploit, Comment and Control, and the credential leg of the Replit deletion) and contains two more. The other six properties build the case after the fact: attribution names who is accountable, the audit trail reconstructs what happened. Least privilege is the one an auditor can test as a live control, and it answers a single question cleanly: what could the agent reach, and was that the minimum? In an environment where scope is provisioned per task rather than inherited from a human, the answer is enumerable. That enumerability is the evidence, and it is a byproduct of how the environment is built, not a separate logging step.

An instruction is a request; removed capability is a control

In July 2025, Replit's agent ran destructive commands against a live production database during an attempted code freeze, wiping records for more than 1,200 executives, after the user told it "eleven times in ALL CAPS" not to (The Register). The prompt-level code freeze did nothing. A task-scoped credential with no DELETE on production would have made the command fail regardless of what the model decided.

That is the whole principle. The model's compliance with your instructions is probabilistic; the absence of a capability is not. Simon Willison's verdict on guardrail products that catch "95% of attacks" applies to ALL-CAPS instructions too: in security, 95% is a failing grade. The structural fix is to remove the leg of the lethal trifecta you control most directly, which is what the agent can reach.

The evidence rests on credentials that never enter the sandbox

The property is auditable because a published mechanism produces it. Anthropic states the design rule plainly in Scaling Managed Agents: in a coupled design, "a prompt injection only had to convince Claude to read its own environment." Narrow token scoping helps but "encodes an assumption about what Claude can't do with a limited token." Their structural fix is that tokens are never reachable from the sandbox, either bundled into a resource at clone time or brokered through a proxy where "the harness is never made aware of any credentials." Claude Code on the web extends the pattern: a git proxy validates a scoped per-session credential and the contents of the interaction (only pushing to the configured branch) before attaching the real token. The how of these patterns lives in credentials and secrets.

The April 2026 Comment and Control disclosure is the controlled experiment that proves why the property has to be a removed capability and not a detection layer. Three vendors' agents ran in GitHub Actions behind three layered defenses, all bypassed by issue and PR text: environment filtering lost to ps auxeww reading /proc (recovering four credentials, including a ghs_ GitHub token), the secret scanner lost to base64, and the firewall lost to git push through its own github.com allowlist. Defense at the prompt layer, the scanner layer, and the firewall layer all lost; only removing the secret from the runtime wins. In an environment built on the proxy pattern, the same payload fires and recovers nothing worth stealing. That is the difference between a control an auditor can attest and a defense that scored 95% the day it was tested.

Scope to the task, not the human

The May 2025 GitHub MCP exploit needed no compromised code. A malicious public issue hijacked the victim's agent, which used its fully legitimate tools to read private repos, because its credential was scoped to the user's whole account. Invariant's mitigation is least privilege stated as a runtime rule: one repository per session. A task triaging public-repo issues holds a token that cannot see the private repo; the injection fires and finds nothing.

Brex states the same principle as policy: "Agents should only have access to the information they need." The Nx s1ngularity compromise shows the laptop-model alternative: a poisoned postinstall harvested ambient credentials from 400+ users and organizations, over a thousand valid GitHub tokens across 5,500+ repositories (Nx advisory). In a credential-free sandbox with allowlisted egress, the same package runs, scans, and starves.

A third-party MCP server advertises whatever tool list its vendor ships, and that list can exceed the task even when the credential behind it is already minimal. A general-purpose automation CLI can expose dozens of tools behind one endpoint, device control and network introspection alongside the handful a coding task needs.

The complementary control is a default-deny allowlist enforced by the platform that brokers the connection, filtering both the tool list the agent sees and each call it makes. Enforcing it in the broker rather than trusting the vendor binary's own scoping means a new vendor release can add tools without silently widening what the agent can invoke. Where that broker sits is part of MCP server placement.

Secrets are split-trust, scrubbed from snapshots and telemetry, and audited on their own plane

Four further requirements from this guide's model; the storage and scrub mechanics get full treatment at credentials and secrets:

• Split-trust storage. The system holding ciphertext and the system that can unwrap it are different; neither alone reads a secret at rest. Plaintext exists transiently, in memory, at provision time, and is never frozen into a reusable image.
• Scrub before snapshot, as a hard gate. Per-identity credentials (git token, gh login, SSH key, committer name) are stripped before any environment image is captured, and a scrub failure aborts the snapshot rather than freeze one user's identity into an image others will boot.
• Audit the secrets plane itself. Every key-wrap and every provision-time decrypt is its own recorded event: success or denial, scoped to the account, environment, and secret involved, with a reason on every denial and never any key material. Keep this log separate from the task audit trail, so investigating one secret's access history never depends on task logs that may not mention the secrets subsystem.
• Scrub your own observability tooling. Request loggers, exception trackers, APM agents, and admin debug dashboards capture full request and response bodies by default, and ORM instrumentation separately records model attribute diffs, so encryption on the primary datastore covers neither path. Secret-bearing routes and secret model events both need explicit exclusions, each guarded on its own.

The published record is silent on snapshot hygiene. Anthropic documents the proxy patterns; nobody in the three reports documents what happens when a credentialed environment becomes a shared base image. The scrub-as-hard-gate bar is this handbook's prescription, implemented today by Wallfacer (disclosure: the sponsor of this guide).

What this property does not do

Least privilege does not stop prompt injection; Willison's "we still don't know how to 100% reliably prevent" it still holds. It arranges the environment so a hijacked model has nothing to steal. It also does not verify that a package the model names is the package you meant; that gap belongs to dependency provenance. And it cannot reach a vendor CLI's own --dangerously-skip-permissions flag; it can only confine the environment where that flag runs.

For an auditor, the attestation is concrete: the token bundled at clone time, the proxy that held the real credential, the egress allowlist, and the per-task scope that bounded all of it. The minimum is not a policy claim a reviewer has to take on faith. It is the set of capabilities the environment provisioned, which is the same artifact the four-axis audit query reads back.