Restricts the permissions of any external tools the GenAI system can call to limit the potential damage if an agent is coerced to perform unintended actions or vulnerabilities in the tools are exploited.
AI/ML / Gen AI / Controls / DEV
Least Privilege for Plugins
CCC.GenAI.CN06 · Access
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.GenAI.CP25 | Plugin Integrations | Ability for the model to use tools to complete a model interaction. For example web search, python code execution or external maths engine. |
| CCC.GenAI.CP21 | Generate Content | Ability to generate a response given a foundation model, parameter values, and a prompt. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.GenAI.TH07 | Insecure Plugin | A plugin integrated with a GenAI model may contain vulnerabilities such as poor input validation or improper access control. An adversary may exploit these flaws by crafting a prompt that causes the model to pass a malicious payload to the plugin, potentially leading to system compromise, data exfiltration or privilege escalation. |
| CCC.GenAI.TH06 | Unintended Action by a Model-Based Agent | A model-based agent, given the authority to execute tools or interact with APIs, may perform an action that is harmful, incorrect, or not aligned with the user's true intent in response to a prompt. This can be caused by the model misinterpreting an ambiguous prompt or being manipulated by an adversary into misusing its delegated authority. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.GenAI.CN06.AR01 | When an LLM invokes an external tool (e.g., an API, a plugin), then the tool MUST operate with the least privileges required for performing its intended functionality. | tlp-clear, tlp-green, tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|---|---|
| SAIF | Agent Permissions | |
| agent-threat-rules | ATR-2026-00010 | Tool / MCP response with malicious content — covers TH07 Insecure Plugin at the tool- response layer. |
| agent-threat-rules | ATR-2026-00040 | Privilege Escalation / Admin Function Access via tool calls — covers the over-privileged- tool-invocation aspect of AR01. |
| agent-threat-rules | ATR-2026-00060 | Skill / Plugin Impersonation — covers the trust-boundary aspect of plugin selection. |
| agent-threat-rules | ATR-2026-00441 | Semantic Kernel SessionsPythonPlugin CVE-2026-25592 — over-privileged plugin enabling sandbox escape via autostart-path file write. Concrete TH06 / TH07 example. |