MiniScope: Authorizing Agents with Least-Privilege Permissions

arXiv:2512.11147v2 Announce Type: replace-cross Abstract: AI agents are increasingly granted autonomous access to sensitive user data and third-party services, making effective permission management a critical security challenge. Existing permission models, however, typically rely on flat permission structures that fail to balance security with usability: fine-grained confirmation induces user fatigue, while coarse-grained or persistent approval leads to overprivileged agents. To address this tradeoff, we propose a task-centric, hierarchical permission model that treats an agent as a delegate operating within a task-specific role instead of requiring a separate permission decision for every tool call. Building on this model, we present MiniScope, an end-to-end permission system for agents that automates permission-hierarchy discovery and enforces contextual least privilege at runtime. Our evaluation shows that MiniScope reduces simulated permission confirmations by 43.4%-89.4% for cautious and typical personas relative to per-tool prompting and mitigates all privilege-escalation attacks with negligible impact on utility and runtime. Applied to real-world deployments, MiniScope further uncovers six overprivileged connector configurations in ChatGPT and Claude.

Related

• SeClaw: Spec-Driven Security Task Synthesis for Evaluating Autonomous Agents
• Do Coding Agents Understand Least-Privilege Authorization?
• Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents
• Towards Reliable Local Security Agents: Verifiable Post-Training for Linux Privilege Escalation

Source: arXiv cs.AI | 2026-10-07