The principle of least privilege grants users and agents only the permissions they need for their tasks. In agentic systems, that means limiting access to tools, databases, and other services rather than granting broad access by default. section 8.4.3
Treat permissions as part of the agent’s operating boundary: verify identity before exposing account data, then provide only the user’s role and associated tools. Narrow scopes reduce unnecessary access while keeping responsibilities focused. section 11.2
Apply least privilege with these practical rules:
- Scope access to the specific tools and resources required, such as selected databases or services. section 8.4.3
- Verify identity before account actions or revealing account data. section 11.2 section 11.5
- Grant an agent the user’s role and associated tools instead of unrestricted capabilities. section 11.2
- Combine access boundaries with secret management, tool sandboxing, and defenses against prompt injection. section 8.6
Customer-support triage
A support agent can use a retrieval agent and an escalate_to_human tool, while its instructions require identity verification before account actions and escalation for unclear or sensitive cases. This keeps the agent’s capabilities aligned with its support role. section 11.2
Listing 11.5 06_support_agent_tips.py
from agents import Agent, function_tool, ModelSettings
@function_tool #1
def escalate_to_human(ticket_id: str, reason: str) -> str:
"""Escalate this conversation to a human. Use for angry users, large refunds, or unclear policy."""
return f"Escalated ticket {ticket_id}: {reason}" #2
retrieval_agent = Agent(... ) #3
support = Agent(
name="Triage Support Agent",
instructions=(
"Verify identity before account actions. Cite policies. "
"If unsure or user is upset, call escalate_to_human."
"Pass on complex queries to retrieval_agent." #4
),
tools=[escalate_to_human, retrieval_agent.as_tool()],
model_settings=ModelSettings(tool_choice="auto")
)
Inspect a compact support-agent configuration that exposes only escalation and retrieval tools, with identity and handoff rules in its instructions. section 11.2
