What is Least Privilege (MCP)?

The principle of least privilege is one of the oldest and most fundamental concepts in information security. First articulated by Jerome Saltzer in 1974, it states that every subject should operate using the least set of privileges necessary to complete its task. For AI agents with MCP tool access, this principle is not just relevant — it is critical.

Traditional software systems enforce least privilege through role-based access control, IAM policies, and network segmentation. MCP has no built-in equivalent. The protocol connects clients to servers and exposes tools — there is no native mechanism to restrict which tools an agent can call or what arguments it can pass. This gap means that without external enforcement, every agent operates with maximum privilege by default.

Implementing least privilege for MCP requires answering three questions for each agent deployment. First, which MCP servers does the agent need to connect to? Second, within those servers, which specific tools does the agent need? Third, within those tools, what argument ranges are valid for the agent's task? Each layer of specificity reduces the attack surface.

The practical challenge is that least privilege requires upfront analysis of what each agent needs. This is effort that teams often skip in favour of broad access. The result is over-permissioned agents with unnecessarily large blast radii — exactly the situation least privilege is designed to prevent.

PolicyLayer is purpose-built for implementing least privilege in MCP. YAML policies define per-server, per-tool, per-argument constraints that scope an agent's permissions to exactly what is needed. The fail-closed default denies any tool not explicitly allowed, making least privilege the automatic posture rather than something you have to opt into. Argument conditions in policies constrain not just which tools are callable, but how they can be called — restricting file paths, query patterns, and parameter values to the minimum required range.