Least privilege means a system, a service account, or an AI agent only ever holds the specific permissions its current task requires, scoped as narrowly as possible, and never the broad standing access that would simply be convenient. A read-only reporting job gets read access to one dataset, not admin rights to the database it sits in. The principle predates AI by decades, but agentic systems make it load-bearing rather than optional.
The reason it matters more for agents than for traditional software is that an agent’s actions aren’t fully predictable in advance. A conventional service does exactly what its code says; an agent decides, at runtime, which tool to call and with what arguments, influenced by whatever it has read in its context. If that context has been manipulated, through a poisoned document or an injected instruction, the blast radius of the mistake is bounded by whatever the agent was allowed to touch, not by what it was expected to touch. Broad, standing credentials turn a contained error into an incident.
The practical version of the principle is scoping credentials per task instance rather than per service account, and pairing that scope with a policy check on every proposed action, not just at login. An agent that can read customer records for one support ticket should hold a token that expires with that ticket, not a key that quietly grants the same access for every ticket it will ever handle.