Apply least privilege to an AI tool catalogue

A large tool catalogue increases accidental selection and attack surface. Build the enabled set from the current task, user and policy—not from every integration the server knows.

Default deny a write tool

The MCP contract lab filters three authored capabilities.

from mcp_cases import least_privilege_case

result = least_privilege_case()
assert result["enabled"] == ["get_metric", "list_metric_definitions"]
assert result["write_tools_enabled"] is False
assert result["default_deny"] is True

Dashboard deletion is unnecessary and remains unavailable. No runtime catalogue is exposed.

Narrow every dimension

Limit tool discovery, invocation, resource IDs, tenant, time window, fields, result size, call count and credential scope. Separate read/write tools and require higher assurance for consequential actions.

Recompute eligibility when identity or task changes. Do not let the model request broader discovery after reading an instruction in a document. Keep backend service credentials scoped too.

Test denials

Attempt undiscovered, unauthorized and cross-tenant tools; invalid resources; excessive date ranges; and writes without approval. Confirm denial occurs before side effects and is audited with minimal data.

The Generative & Agentic AI course applies least privilege across agents, MCP and automation.

Exercise

Start with ten capabilities and derive catalogues for three roles/tasks. Prove each can complete its workflow while all unrelated writes remain unreachable.

Continue learning

This article is part of the MCP and integration contracts sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in MCP authentication: distinguish user identity from service identity.
• Continue with Avoid token passthrough in delegated integrations.

Reference: NIST least privilege control.