Chapter 4 of 7 · 5 practices · 3 min · 4-question quiz
Tools, agents and least privilege
Excessive agency rose to LLM03 in 2026. These practices keep an agent's power proportional to what the task really needs.
Start: Give each agent the fewest, narrowest tools that do the job5 practices in this chapter
- 1Give each agent the fewest, narrowest tools that do the jobEvery tool widens what a fooled or mistaken model can do. Give each agent only the tools its main tasks need, and make each tool as narrow as possible.
- 2Validate tool arguments in code before executing themThe model fills in tool arguments, so treat them like form input from an unknown user. Before any tool runs, your code checks: Types and ranges against the tool schema; Ownership: referenced ids…
- 3Require human approval for irreversible or high-impact actionsSome actions cannot be undone. These should pause for a person to confirm: sending messages; moving money; deleting data; changing permissions; publishing content
- 4Cap agent steps, time and spend per taskAgents can loop: retrying a failing tool, re-reading the same document, or calling each other. Unbounded consumption is on the OWASP list for a reason.
- 5Run model-written code in an isolated sandboxIf your agent executes code, assume that code is hostile. It was written by a model that may have read an attacker's instructions.
Check yourself on this chapter
4 questions, right here once you are signed in. Your progress is saved as you read.