Last updated:
A security and governance principle stating that AI agents should only be granted the minimum level of autonomy and tool-access necessary to complete a specific task.
While Least Privilege handles access to files, Least Agency handles access to actions. Inspired by the security principle of Least Privilege, Least Agency prevents the deployment of over-powered agents where simpler, non-autonomous automation would suffice. It ensures that if an agent is hijacked (ASI01), its potential for cascading harm (ASI08) is strictly limited by its narrow functional scope and inability to invoke unapproved tools.
Real world example:
An email summarizer is given Read-Only permissions to the inbox but is denied Send or Delete rights, effectively enforcing Least Agency.
