Least Exposure Is Broader Than Least Privilege
Bounding What an Agent May See, Not Just What It May Do
Companion to
Designing Mission-Bound Authorization
Least privilege scopes what an agent may do, one tool call at a time. But a perfectly authorized agent can still be compromised by what it is allowed to see. Least exposure is the broader control: task-scoped minimal disclosure for prompt context, retrieved documents, tool schemas, secrets, business rules, approval context, memory, and downstream responses. Because the model is untrusted reasoning, every input is attack surface. A Mission should therefore bound both halves: the actions the agent may take and the working set it may reason over.