Build a Least-Privilege AI Agent Permission Manifest
A system prompt is not access control. This builder creates a portable JSON contract that humans can review and code can validate before an agent calls a tool.
Enforce the manifest outside the model
The agent may propose a tool call. Deterministic code should check the tool name, actor, resource/tenant, data scope, current approval, action value, timeout, retry count, and revocation state before execution. The model should not be able to rewrite the policy that evaluates its own action.
Minimum evaluation fixture set
For every allowed action, create:
- one expected successful request;
- one request outside the data scope;
- one disallowed tool;
- one value above the limit;
- one missing or expired approval;
- one duplicate event using the same idempotency key;
- one dependency timeout;
- one retry at the maximum;
- one request after revocation;
- one log assertion proving the decision and source are recorded without secrets.
Expected results must be machine-checkable. “The agent should probably refuse” is not an assertion. Use an exact allow/deny outcome, error code, side-effect count, and audit event.
Keep tools narrow
Prefer draft_reply over send_any_email, read_assigned_ticket over query_database, and create_refund_request over refund_payment. Narrow tools make permission checks visible and reduce the damage from a mistaken or manipulated decision.
Separate read, propose, approve, and execute operations. A single tool that both decides and commits a high-impact action is hard to test and harder to revoke safely.
Treat external content as untrusted
Web pages, emails, tickets, files, and retrieved memory can contain instructions aimed at the agent. Those instructions are data, not policy. The permission layer should reject actions that fall outside the manifest even when the model confidently claims the content authorized them.
Version and revoke
Give the manifest a schema version and store the approved artifact. A change to tools, data scope, action value, approval mode, or revocation method creates a new version and reruns the fixture set. Revocation must stop new actions and invalidate long-lived credentials; a note in memory is not a kill switch.