Explain like I'm five · AI Security

What is Per-tool Permission?

Per-tool permission, told as a story about a different badge on each drawer slot — so every tool gets only as much power as it needs.

knifepaydeletethe same key opens every single onepayment, deletion — all of it opens

The same key opens every single one — payment, deletion, all of it.Skip giving each tool its own scope, and everything ends up equally unlocked.

I wasn't sure what this job needed, so just in case, I unlocked everythingthe manager finds it tedious to decide every single timeopening everything for convenience leaves more unlocked than the job ever needed

Opening everything for convenience leaves more unlocked than the job ever needed.Not knowing everything a job needs in advance makes the master key feel like the easier choice.

searchpaydeleteread onlyup to $10noneA Per-tool Permission Badge gives each tool only as much power as it needssearch can only look, payment has a limit, deletion can't even be taken out

Each tool gets only as much power as it needs.Search can only look, payment has a limit, and deletion can't even be taken out.

Exactly as much as neededthe scope differs job by job
Read-only stays read-onlyno write power for search or lookup
Set a limitpayment gets a ceiling
Or no access at allfor risky ones like delete or refund
WHAT EACH TOOL MAY DOsearch — look only, cannot change or deletereading the menu — read onlypayment — up to $10 per userefund · delete — this apprentice can't reach these at alleach tool has its own row — even the same apprentice gets a different scope per job

Each tool has its own row.Even the same apprentice gets a different scope depending on the job.

knifepaythis is isolation — where it runspairs with the locked knife drawereverythingskip the badge, allow everything — and this happenspermission is the design choice of how much to grant up front — letting that drift into too much becomes a different, named problem

Permission is the design choice of how much to grant.A locked knife drawer isolates where a tool runs; this page is about deciding how much to grant in the first place. It's least privilege from the security world, applied one tool at a time.

In one breath

Per-tool permission = giving each drawer slot its own badge, so every tool gets only as much power as it needs. Search can only look, payment has a limit, deletion can't be taken out at all.

A design where each tool (function call) an LLM agent can use is granted its own scope — what actions it may take, over what range, up to what limit — instead of giving every tool the same blanket access: read vs. write, spending caps, which data it may reach. It's the principle of least privilege applied to the specific point of an agent's tool use, and it pairs with tool sandboxing (isolation).

When grown-ups say it

Per-tool Permission
A different badge on each drawer slot. Each tool gets only as much power as it needs.
Least Privilege
The general principle from the security world. This is that principle applied tool by tool. → What is Least Privilege?
Tool Sandbox
The isolation that contains where a tool runs. The paired page just before this one. → What is a Tool Sandbox?
Tool Calling
The apprentice taking a tool out to use it. The permission badge is checked every time this call happens.
Agent
The apprentice running errands. Without a badge, the apprentice can end up widening its own reach. → the apprentice handed too many keys
Guardrail
The tasting checkpoint. The badge fences the tool side; the taster fences the output side.
Incident Response
The bell you ring once an accident happens. A tighter badge means fewer reasons for that bell to ring.
Governance Approval
The rule the manager sets ahead of time. Who gets which badge is, in the end, a decision a person makes.
Next story
The Order That Won't Let the Stove Rest →
Want another term as a picture book? Request →