An engineering team is configuring the tool manifest for a new AI agent that handles customer billing questions via a chat interface. The team is debating which tools to include.
An LLM agent has a tool manifest with the following tools: read_database, write_database, execute_shell, send_email, read_file, delete_file. The agent's purpose is to answer customer billing questions. Which tool set follows the principle of least privilege?
- A.C. All tools - anticipate future use cases
- B.B. read_database, write_database, send_email - may need to update records for billing corrections
- C.A. read_database, send_email - read billing records and communicate results
- D.D. read_database, execute_shell - shell execution provides maximum flexibility
Why C is correct
A billing Q&A agent requires read access to the database (to look up records) and email capability (if responses are communicated via email) - nothing more. write_database for billing corrections should require a separate human-reviewed workflow, not autonomous LLM action. execute_shell is never needed for billing Q&A and provides massive capability for exploitation. delete_file and read_file are irrelevant to the stated purpose. The pattern is: provision only what the specific described function requires, not what might be useful in the future.
Know someone studying for AI Security Fundamentals? Send them this one.