Knob

Least privilege

You might say: minimum permissions, narrow token scope, permissions block

The smallest set of identities, API scopes, files, and actions a run needs to finish its task. Every omitted permission is a deliberate barrier.

What it does
Shrinks the blast radius when a tool, dependency, or model decision is wrong or compromised.
Ask
Which exact read, write, publish, and cloud actions does this task require?
Typical
Start with no permissions or contents: read, then add one job-level scope at a time. Keep publish, deploy, and identity-token access separate.
Trouble
A read-only task can push code, a token reaches unrelated repositories, or a broad permission is inherited by every job.

What to look for

  1. A permissions block with read and write scopes named
  2. A token that expires with the job
  3. A denied API call for an omitted scope

Connections

Sources

  1. GitHub, Use GITHUB_TOKEN for authentication in workflows, Using the GITHUB_TOKEN in a workflowAs a good security practice, you should always make sure that actions only have the minimum access they require by limiting the permissions granted to the `GITHUB_TOKEN`.
  2. GitHub, Use GITHUB_TOKEN for authentication in workflows, Modifying the permissions for the GITHUB_TOKENAs a good security practice, you should grant the `GITHUB_TOKEN` the least required access.
  3. OWASP GenAI Security Project, LLM01:2025 Prompt Injection, Prevention and Mitigation StrategiesRestrict the model’s access privileges to the minimum necessary for its intended operations.
  4. Heather Adkins et al., Building Secure and Reliable Systems, Design for Least PrivilegeThe objective of least privilege should extend through all authentication and authorization layers of the system.

Use it on your project

teardown-apply: hold "Least privilege" (least-privilege) from the teardown at https://teardownatlas.com/software-factory/ against my project

Paste it into a coding agent that has the teardown skills.

An AI agent wrote this map with the teardown skill. It can contain errors: check the sources before you rely on a part. About and legal