Unit 04.03: Scoping what each agent is allowed to see

Least privilege in a crew is a list of tools per agent, and it is the one control that does not depend on the model behaving.

The tool is absent, not forbidden

An agent that cannot issue a refund is one whose tool list does not contain the refund tool. That is different in kind from an agent instructed not to.

The code builds an analyst and an approver with different tool lists.

from crewai import Agent
from crewai.tools import tool


@tool("read_account")
def read_account(account_id: str) -> str:
    """Read-only account lookup."""
    return f"record for {account_id}"


@tool("issue_refund")
def issue_refund(account_id: str, amount: float) -> str:
    """Issue a refund. Changes money."""
    return f"refunded {amount} to {account_id}"


analyst = Agent(role="Billing analyst", goal="Explain charges",
                backstory="You explain. You do not act.",
                tools=[read_account], allow_delegation=False)
approver = Agent(role="Refund approver", goal="Issue approved refunds",
                 backstory="You act only on an approved decision.",
                 tools=[read_account, issue_refund], allow_delegation=False)

for agent in (analyst, approver):
    names = [t.name for t in agent.tools]
    can_act = "issue_refund" in names
    print(f"{agent.role:18} tools={names}  can move money: {can_act}")

# Least privilege per agent. The analyst physically cannot issue a refund --
# not because its instructions say not to, but because the tool is not in its
# list. That distinction is the whole point.

The analyst physically cannot move money. Not because its backstory says so, but because issue_refund is not in its list - there is no phrasing of any input that makes the capability appear.

That distinction is what you can state to an auditor. "The agent is instructed not to" is a probability; "the agent does not have the tool" is a fact about the configuration.

The mistake this prevents

There is a quality argument alongside the security one. An agent choosing between three tools picks the right one reliably; an agent choosing between fifteen picks a plausible neighbour more often, because selection is itself a judgement that gets harder as the list grows. So a large tool list widens the risk surface and degrades the choosing at the same time. Give each agent the smallest list that lets it finish its job.

The mistake is giving every agent every tool for convenience and relying on roles to keep them apart. It works until an agent is handed content from outside your organisation containing text designed to trigger a tool call - at which point the only thing between that text and the effect is the model's judgement.

Takeaway

Scope tools per agent to exactly what its job requires. A capability the agent does not have is a guarantee; a capability it is told not to use is a hope.

Mark complete