A Least Privilege Framework for Authorizing Tool Calling Agents
Tool-calling agents are an emerging paradigm in LLM deployment, with major platforms such as ChatGPT, Claude, and Gemini adding connectors and autonomous capabilities. However, the inherent unreliability of LLMs creates fundamental security risks when these agents operate on sensitive user services. Prior approaches either rely on LLMs in the confinement loop, which lacks rigorous security guarantees, or require manually written policies that requires expertise in security. We present MiniScope, a framework that enables tool calling agents to operate on user accounts while confining potential damage from unreliable LLMs. MiniScope introduces a novel way to automatically and rigorously enforce least privilege principles by reconstructing permission hierarchies from existing authorization protocols and combining them with a mobile-style permission model to balance security and ease of use. To evaluate MiniScope, we create a synthetic dataset derived from ten popular real-world applications, capturing the complexity of realistic agentic tasks beyond existing simplified benchmarks. Our evaluation shows that MiniScope incurs only 1–6% latency overhead compared to vanilla tool-calling agents, while significantly outperforming the LLM-based baseline in minimizing permissions as well as computational and operational costs.