Safety & Security · Data artifact
Least-Privilege Permission Set
Data artifactSafety & SecuritySafety, Security & Governancearc:LeastPrivilegePermissionSet
A declarative grant of the minimum object-, operation-, field- and record-level permissions an agent identity needs, starting from a default of zero access.
Responsibility. Specifies exactly which data objects, operations, fields and records an agent may touch.
Also known as: Granular permission set, Organization-Wide Default + sharing rules, Least-privilege IAM role
Relationships
is read by dependency
receives data from dynamic
constrains control
- Agent Controller abstract Ch9.2 Ch9.3
- Execution Sandbox abstract Ch9.3
is audited by assurance
Design guidance
- MUST start with zero access and incrementally grant only permissions the task requires.
- MUST NOT assign administrative, 'Modify All Data' or cloned administrator profiles to agents.
Quantitative guidance
As stated by the sources; verify before use.
- Average cost of a data breach cited as $4.45 million (Ch9.2).
Classification
- Patterns
- Principle of least privilege (PoLP)Default-deny (OWD Private) with targeted sharing rulesObject/operation/field/record-level scoping
- Quality attributes
- Security (ISO/IEC 25010 | NIST AI RMF: secure and resilient)
- Risks mitigated
- Excessive agencyFull-system compromise from a single vulnerabilityData exfiltration
Sources
- Ch9.2: T. Nguyen, "Action Constraints and Permission Models," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 9.2. ISBN: 9798244538229.