Least privilege for AI agents: a practical permission map
Map an AI workflow to the smallest tools, data scope, identities, and time limits it needs, then verify denied actions with synthetic fixtures.
Read the guideTopic 01
Permissions & scope
Define the identity, resources, and authority behind an agent.
Where a model gateway policy stops: finding bypass paths
Trace direct SDK calls, fallbacks, workers, tool traffic, and copied credentials to check which model requests actually cross a gateway policy boundary.
Read the guideTenant isolation for AI retrieval, caches, and background jobs
A two-tenant authorization matrix for document retrieval, shared answer caches, delayed workers, and stored model artifacts, using synthetic records only.
Read the guide