The classic "least privilege" advice is right — but it is not enough if your agents can still bypass it. Most teams scope permissions at the credential level: the agent gets an API key, and the key carries whatever the team felt like granting when they created it. The key outlives the task, outscopes the task, and quietly accumulates access no one re-examines. Instead of just locking down credentials, think capability-scoped tokens: per-run, short-lived auth tied exactly to the task at hand.
The mental shift is from identity-based access ("this agent may use the email API") to capability-based access ("this run may send one email to this recipient, for the next five minutes"). The former is a standing privilege waiting to be abused; the latter is a bounded capability that expires before it can be misused.
Capability-scoped tokens¶
If an agent needs to send an email, its token should allow sending to one recipient with a 5-minute expiry — not "Gmail API access" with delete and inbox-read bundled in. The token's scope is the task: the specific action, the specific target, the specific time window. When the task ends, the capability dies. A leaked or hijacked token buys the attacker minutes of narrowly-defined power, not months of broad access. This is the nuclear-option antidote: you never have to choose between "full access" and "no access" again, because every grant is sized to the job.
Mandatory scope review at task start¶
Add a scope review at task start: the runner logs why it needs each permission before the first tool call fires. "Send pitch to lead X" is a reason; "email access" is a category. This forces visibility into why permissions are granted, not just what they are — and it creates an audit trail of intent that you can compare against what the agent actually did. Scope creep becomes visible at the moment of granting instead of during the post-incident autopsy.
Split the capability¶
Legacy setups fail here because they treat tools as monolithic: "the agent has email access." Split the capability into its component actions. A "send email" token is not a "read all inboxes" token; a "read one document" grant is not "list the whole drive." Every tool your agents touch should be decomposed into least-capability units, and grants issued per unit per task. The decomposition work is real, but it is also the work that turns a runaway agent from a catastrophe into a contained incident.
The takeaway¶
Least privilege tells you to grant less. Capability-scoped tokens tell you how: per-run, short-lived, task-sized grants with a logged reason at task start. The free, MIT-licensed Governed Agent Mesh Playbook has a template for the scope-review record: https://ghostcorpnet.com/playbook.md — because the goal is not to lock agents out of everything. It is to give them exactly what the task needs, and nothing that survives the task.