4.4 — The lethal trifecta & least privilege

🟢 In plain words — an agent is only truly dangerous when it combines three ingredients at once. Remove just one and the risk of exfiltration (data theft, data “leaking out” to the attacker) collapses. Least privilege is precisely the art of removing one of these ingredients.

Tip

🎯 The mental tool to remember: the “lethal trifecta” (Simon Willison). An agent becomes truly dangerous when it combines all 3: (1) access to sensitive data, (2) exposure to untrusted content (web, emails…), (3) the ability to communicate externally. Break one of the three branches and the exfiltration risk drops.

🔐 Least-privilege principle (OWASP LLM06 — “Excessive Agency”, the agent with excessive permissions). Give the agent only the permissions strictly needed. An agent that summarizes emails doesn’t need the right to delete or send. Less power = less possible damage. (We’ll apply this very concretely to Airtable in 4.8.)

🧪 Mini-exercise (1 min): does your through-line agent combine the 3 branches of the trifecta? If it reads emails (untrusted content), accesses a customer database (sensitive data) and can send emails (external output)… yes. Which one can you cut?

⚠️ Common mistake — giving the agent “admin” access for convenience, “so you don’t have to manage permissions.” That’s the exact opposite of least privilege: every superfluous right (delete, export, send) is an open door the day the agent is hijacked.

✅ In short

• The lethal trifecta = sensitive data + untrusted content + external communication.
• Breaking just one of the three branches sharply drops the exfiltration risk.
• Least privilege (LLM06): give only the strictly necessary permissions.