MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents

TL;DR

MiniScope is a security framework for tool calling agents that enforces least privilege principles automatically, reducing risks from unreliable LLMs while maintaining low latency and operational efficiency.

Contribution

MiniScope introduces a novel permission hierarchy reconstruction and mobile-style permission model to automatically enforce least privilege in tool calling agents.

Findings

MiniScope achieves only 1-6% latency overhead.

It significantly reduces permissions compared to baselines.

MiniScope outperforms existing methods in security and efficiency.

Abstract

Tool calling agents are an emerging paradigm in LLM deployment, with major platforms such as ChatGPT, Claude, and Gemini adding connectors and autonomous capabilities. However, the inherent unreliability of LLMs introduces fundamental security risks when these agents operate over sensitive user services. Prior approaches either rely on manually written policies that require security expertise, or place LLMs in the confinement loop, which lacks rigorous security guarantees. We present MiniScope, a framework that enables tool calling agents to operate on user accounts while confining potential damage from unreliable LLMs. MiniScope introduces a novel way to automatically and rigorously enforce least privilege principles by reconstructing permission hierarchies that reflect relationships among tool calls and combining them with a mobile-style permission model to balance security and ease of use. To evaluate MiniScope, we create a synthetic dataset derived from ten popular real-world applications, capturing the complexity of realistic agentic tasks beyond existing simplified benchmarks. Our evaluation shows that MiniScope incurs only 1-6% latency overhead compared to vanilla tool calling agents, while significantly outperforming the LLM based baseline in minimizing permissions as well as computational and operational costs.