Agent tools and credentials not scoped to least privilege

Declare each agent's allowed tools and credentials explicitly, grant only what its task needs, and keep destructive operations off unless a grant names them.

A per-agent scope declaration that the runtime reads lists the tools, APIs, data, and credentials the agent gets and marks which operations are destructive; the agent is built from that list rather than ALL_TOOLS, a wildcard allowed_tools, or an unrestricted ShellTool / PythonREPLTool. Destructive or irreversible tools (delete, transfer, deploy, external send) are registered only when the grant opts in. The agent's cloud or database identity is a narrow role (named actions on named resources, a read-only DB user), issued as short-lived credentials, and the agent has no path to pick up credentials from repositories, env files, or content it reads.

Where it goes: 3 config and feature flags, 15 agent action surface, 4 infrastructure-as-code.

What reviewers look for: an explicit tool list per agent (no "*", no Bash(*), no allowed_tools missing on an agent with shell access); shell or code-execution tools absent, sandboxed, or limited to a command allowlist; IAM or database grants without "Action": "*", write actions on "Resource": "*", roles/owner, roles/editor, or a superuser connection string; destructive tools off by default.

agent = create_react_agent(llm, tools=[ShellTool(), PythonREPLTool(), *crm_tools])

scope = load_agent_scope('support-agent')   # declared tools; destructive ops opt-in
tools = [t for t in crm_tools if t.name in scope.allowed_tools]   # e.g. lookup_order, read_ticket
if scope.grants('issue_refund'):
    tools.append(issue_refund)
agent = create_react_agent(llm, tools=tools)

Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.