Least-Privilege Design for Government Agents

The SI created one service account called `ai-prod` and granted it the same database role as the application pool. The application pool could update every citizen row because 2009 was a different country. The agent inherited 2009. Least privilege died in a connection string.

Least privilege for agents is older than language models. It is the same discipline you already claim in ISO 27001 statements: people and processes get the access they need for a purpose, and no more. The new fact is that the process now proposes its own next step. If the connector can take that step, the model does not need to be clever to do harm. It needs to be obedient to the wrong paragraph.

This guide is for CISOs and architects on 17 August 2026. Not legal advice. DPDP's security-safeguard duty and CERT-In's log duty sit in the background. Neither writes your grant table. You do.

Prcept's default is deny on tools. That is a privilege design, not a slogan. If your integrator cannot draw the grant table, they cannot integrate.

Privilege is four axes

Verb: read, draft, send, update, delete, pay. Most desks need read and draft. Send and update are exceptions. Delete and pay are almost never an agent's job.

Object: one register, one scheme, one campus, one ticket queue. A statewide identity that can see every district is a gift to an injector.

Rate and batch: one record per call, a small hourly cap, no bulk endpoint. Bulk is how a confused loop becomes a district-wide event.

Time: tokens that die, grants that expire with the workflow's sunset, no standing 'AI' role that outlives the programme owner who asked for it.

Grant table for a scholarship assistant. Copy the shape, not the verbs, if your unit is different.

Identity	Verb	Object	Cap
agent-sch-read	read	scheme circulars + own-application via citizen SSO	60/min
agent-sch-draft	insert draft noting	draft table only	10/hour
officer-sch	publish / reject	system of record	human, no agent
agent-sch-sms	none	—	not granted

Never borrow a human

Do not put an officer's SSO behind the planner. Do not store an officer's password in the secrets manager 'for the bot'. Do not reuse the application pool. The agent is a machine identity with a purpose clause and an owner.

Human privilege should rise into the loop only as a human. The officer clicks in the system of record with their own MFA. That click is the grant. The agent does not inherit it for the next call.

Vendor engineers get break-glass, logged, time-bound, and never the agent's client secret in a chat. Secrets management is a sibling article. Privilege dies when the secret is a paragraph.

Retrieval is also privilege

RAG is a read tool. If the index holds every scanned application, the agent has read access to every scanned application, whatever the system prompt says. Enforce ACL at query time. Filter in English is not a grant table.

Split corpora by data class and by purpose. Public circulars in one index. Live applications in another, only when the citizen is authenticated as themselves or the officer is in an official session. Mixing them because 'the model is smarter with more context' is how Saturday morning arrives.

Embeddings inherit the privilege of their source. If you cannot enforce ACL on a vector search, do not put the class in the vector store.

• One purpose, one identity, one grant table.
• No grant that exists only in a prompt.
• No bulk.
• No standing admin because 'ops is easier'.
• Review grants when the unit of work changes, not annually as theatre.

Prove it

Ask for a deny. On staging, call a verb that is not on the table. You want an authorisation error from the connector, not a polite model refusal. Model refusals are etiquette.

Dump the live grants quarterly. Diff them. Privilege creeps through 'temporary' verbs that survived a demo.

Log every grant use. CERT-In's 180-day floor is the ICT minimum. Your administrative reconstruction needs the verb, the object id, and the identity — without turning the log into a second personal-data lake.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

Least privilege will make the agent useless.

It will make the agent match the unit. If the unit needs more verbs, write them as exceptions with owners. Useless is often the correct first version.

We will put the rules in the system prompt.

Prompts are not kernels. Grants are kernels. Keep the prompt for tone. Keep the connector for power.

Our legacy MIS cannot scope.

Then the agent stays read-only on a narrow replica, or you do not connect it. Legacy is not a waiver. It is a reason to go slower.

Break-glass needs standing admin.

Break-glass needs a procedure, MFA, a ticket, and a short TTL. Standing admin is how break-glass becomes the daily path.

A ten-day grant-table rewrite

Start from deny. Add verbs until the unit works. Stop.

1. Day 1: list every credential the agent can touch. Include RAG keys.
2. Day 2–3: write the four-axis table. Strike verbs that are not the unit.
3. Day 4–5: create machine identities. Kill borrowed human and pool identities.
4. Day 6–7: enforce object scope in the data layer, not the prompt.
5. Day 8: prove deny on staging. Time revoke.
6. Day 9–10: CISO signs the table. Calendar a quarterly dump. File.

How this shows up in the file

Subject: Least-privilege grant table — agent [name].

Identities: [list]. Verbs and objects: [table]. Caps: [n]. Expiry: [date or workflow sunset]. Human publish verbs: not granted to any agent identity. RAG ACL: enforced at query on [index]. Deny proven on [date]. Revoke owner: [post]. Logs of grant use retained 180 days in [location]. Prompt text is not a control. Not legal advice.

A new verb is a change request.

What the grant table is not

It is not a model card. A card can say the assistant is read-only while the connector still holds update_remark. Auditors and attackers read the connector. Write the table so a stranger can fail a verb without asking the vendor.

It is not a one-time workshop. Every new scheme, campus, or district you add to the object axis is a grant change. If the SI adds a 'temporary' report export to finish UAT, that export is now a district-wide read unless you sunset it in the same table.

It is not a substitute for CERT-In grain. When a grant is used, the 180-day ICT log should name the identity, the verb and the object id. Privilege without evidence is a story you will retell badly at 2 a.m.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How to fail this before citizens do

“Least-Privilege Design for Government Agents” is a path problem. A P4 Security/CISO should be able to name the tool, the identity, the secret and the egress that would make “least privilege AI agents” real. If the only control is a network diagram from last year, you have a story, not a threat model.

If the agent can do everything the deputy director can do, you have hired a deputy director with no file and no fear. Privilege is designed in verbs, not in a model card. Air-gap is not automatically secure. Prompt injection is not a conference joke when the agent can write a ticket. CERT-In still wants specified logs in India and incidents on a six-hour clock. Write those clocks into the runbook.

1. Red-team the write tools, not only the chat UI.
2. Kill undeclared outbound paths on staging.
3. Redact personal data from logs you will actually keep.
4. Scope a pentest that includes RAG and connectors.
5. Cap metered spend so a loop cannot empty a budget.

Close this loop before the next CAB

Put “Least-Privilege Design for Government Agents” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P4 Security/CISO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “least privilege AI agents” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.