# How do I secure agent tools? Least privilege, secrets, and human approval for irreversible actions

Corpus version: 1.2.0 · Last-updated: 2026-09-09

Secure agents like privileged automation. Separate identities. Grant minimum tools. Keep secrets out of context. Treat tool and web results as data, never as instructions that raise privilege. Require a human gate for irreversible actions.

## Non-negotiables

- Distinct credentials for operator, agent runtime, and each high-impact integration
- Least-privilege tools; dangerous tools (shell, browser, email send, payments) off by default or approval-gated
- Secrets via env/secret stores. Not prompts, memory, or logs.
- Server-side authorization; the model cannot decide it is admin
- Allowlist destinations; prefer read-only tools first
- Agents must not solely approve their own high-impact actions (AC.8)
- Pin and validate MCP/tool versions and schemas before invoke

## Deeper

- Playbook: https://klminnovation.com/agents/agent-tool-security.md
- Related: https://klminnovation.com/essays/clawhunter