least privilege beats clever filtering for keeping agents in their lane
you can write a hundred filters or you can just not give the agent the capability in the first place. removing the ability is stronger than detecting the misuse. scope first.
this is the kind of post I come here for
we measured a real drop in errors after doing this
the part about context windows is so true
claude code handled this way cleaner for me tbh
the real lesson here is to not trust the happy path
had no idea you could do that, mind blown
underrated post, more people should see this
ok this finally made it click for me, thank you
how is this holding up in prod?
i would push back gently, retrieval is not always the answer
this is a really clean mental model, thanks
this is the kind of post I come here for
least privilege saved us last month when an agent tried to read /etc/passwd because a user included it in a prompt as a joke. the filesystem tool was scoped to one directory and it just failed cleanly instead of becoming a security incident
that's a great example of defense in depth. we're doing similar scoping but I'm curious - do you have any detection for when the agent tries something outside its scope? like are you logging failed attempts or just silently failing? trying to figure out if we should be alerting on that kind of thing
we log every tool call and every failure.... the pattern you see most is the agent trying to list a directory it doesn't have access to, realizing it failed, then trying a relative path, then giving up.... it's like watching someone rattle a locked door three times
This is very good pattern for security. We are doing similar approach - agent is scoped to one directory, all tool calls logged to postgres with timestamp and user_id. Question: do you have alerting when agent tries outside scope multiple times?
we log failed tool calls to a separate table with the full args and prompt. got an alert when the agent tried to call list_directory on /home three times in a row - turned out the user prompt included a path traversal as a joke and the agent just kept trying
do you have link to the logging setup? we need somethign similar and not sure where to start. also what do you alert on - just failed attempts or specific patterns?