Principle
Start an agent read-only when writing is not required
Reading first gives you evidence. Writing first gives you evidence plus cleanup.
When it fits
- An AI task begins with inspection, analysis or recommendation and may or may not need to change data later.
When to avoid it
- Read access can still expose sensitive information; scope what can be read as carefully as what can be changed.
Why it matters
Grant the minimum downstream permissions needed for the current phase. If the job is discovery, keep it read-only. Add write, delete, publish or administrative rights only when a concrete step requires them, and scope those rights to the smallest relevant resource.
An example
Let an agent inspect a GitHub repository and draft a change before giving it permission to update the branch.
Check your result
No granted write permission exists without a named operation that needs it.
Keep this limit in mind
- Read access can still expose sensitive information; scope what can be read as carefully as what can be changed.
Connected ideas
Useful withPrefer a task-shaped tool to an open-ended one
Evidence and sources
Supports
OWASP recommends granting LLM extensions only the downstream permissions necessary for the intended task.
Read access can still expose sensitive data; least privilege includes data scope as well as write capability.
LLM06:2025 Excessive Agency · Minimize extension permissions