https://notes.karlmcguinness.com/tags/prompt-injection/Recent content in Prompt Injection on Control Plane by Karl McGuinnessHugoen-uspublic@karlmcguinness.com (Karl McGuinness)public@karlmcguinness.com (Karl McGuinness)Mon, 06 Jul 2026 10:00:00 -0700https://notes.karlmcguinness.com/notes/least-exposure-is-broader-than-least-privilege/Mon, 06 Jul 2026 10:00:00 -0700public@karlmcguinness.com (Karl McGuinness)https://notes.karlmcguinness.com/notes/least-exposure-is-broader-than-least-privilege/Least privilege scopes what an agent may do, one tool call at a time. But a perfectly authorized agent can still be compromised by what it is allowed to see. Least exposure is the broader control: task-scoped minimal disclosure for prompt context, retrieved documents, tool schemas, secrets, business rules, approval context, memory, and downstream responses. Because the model is untrusted reasoning, every input is attack surface. A Mission should therefore bound both halves: the actions the agent may take and the working set it may reason over.