Agent Security 2026: Tool Access Control — Least Privilege cho AI Agents

Agent với unrestricted tool access là vũ khí đã lên đạn.

Bài trước covered prompt injection — cách attacker làm agent làm điều không nên. Bài này covers nửa kia: khi agent hành động thiện chí nhưng có quá nhiều quyền. Bug trong tool routing, MCP server quá permissive, hoặc thiếu parameter validation có thể gây damage hơn bất kỳ injection attack nào.

Trong production, tool access control theo nguyên tắc đã dẫn dắt software security 50 năm: least privilege. Cho agent đúng tools nó cần, không hơn. Scope mỗi tool đến minimum set of actions. Validate mọi call. Rotate credentials aggressively.

Vấn Đề: Agents Quá Powerful#

1
# Dở: Một MCP server với tất cả
2
agent = Agent(mcp_servers=[{"name": "super-mcp", ...}])
3
# Exposes 30 tools: read/write DB, deploy, email, admin...

Agent có access 30 tools. Nó dùng 5 tools thường xuyên. 25 tools còn lại là attack surface.

Threat Model#

1
Agent bị compromised (injection)
2
    → Agent gọi dangerous tool
3
    → Tool execute với credentials của MCP server
4
    → Blast radius = whatever MCP server's credentials allow

Principle 1: One MCP Server, One Responsibility#

1
# Tốt: Split MCP servers
2
agent = Agent(mcp_servers=[
3
    {
4
        "name": "read-only-db",
5
        "env": {"DATABASE_URL": os.getenv("READ_ONLY_DB_URL")}
6
        # Read-only credentials. Không write access.
7
    },
8
    {
9
        "name": "github-pr",
10
        "env": {"GITHUB_TOKEN": os.getenv("GITHUB_PR_TOKEN")}
11
        # Token scoped to pull requests only
12
    },
13
])

MCP Server Credential Scoping#

Server	Minimum Credential	Default Risk
Database	Read-only user, specific tables	Full admin → critical risk
GitHub	Fine-grained PAT: contents	Full repo → full access
File system	Specific directory	Home dir → full home
Cloud	Single-service, read-only role	Admin role → everything
Slack	Channel-scoped bot token	Workspace token → all channels

Principle 2: Scope Tools trong MCP Servers#

1
class DatabaseMCPServer:
2
    def __init__(self, access_level: str):
3
        self.access_level = access_level  # "readonly" | "write" | "admin"
4

5
    def register_tools(self, mcp):
6
        @mcp.tool()
7
        async def query_database(sql: str) -> list[dict]:
8
            if not sql.strip().upper().startswith("SELECT"):
9
                raise PermissionError("Only SELECT allowed")
10

11
        if self.access_level in ("write", "admin"):
12
            @mcp.tool()
13
            async def insert_record(table: str, data: dict) -> int:
14
                if table in ("users", "payments"):
15
                    raise PermissionError(f"Cannot insert into {table}")

Agent routing based on role:

1
def get_server_for_agent(agent_role: str):
2
    if agent_role == "support": return readonly_db
3
    elif agent_role == "engineer": return write_db
4
    elif agent_role == "admin": return admin_db
5
    else: return readonly_db  # Default: read-only

Principle 3: Validate Every Tool Call at Runtime#

Parameter-Level Validation#

1
TOOL_RULES = {
2
    "query_database": {
3
        "forbidden_tables": ["secrets", "credentials", "audit_log"],
4
        "max_results": 1000,
5
    },
6
    "send_email": {
7
        "allowed_domains": ["company.com"],
8
        "max_recipients": 10,
9
    },
10
    "deploy_service": {
11
        "forbidden_services": ["production-api"],
12
        "require_human_approval": True,
13
    },
14
}

Context-Aware Validation#

1
class ContextAwareValidator:
2
    def is_expected_tool(self, tool_name: str, context):
3
        """Tool call phải hợp lý với conversation."""
4
        if tool_name == "delete_user" and context.last_tool != "verify_identity":
5
            return False  # Phải verify identity trước khi delete

Principle 4: Credential Management#

1
class CredentialManager:
2
    rotation_schedule = {
3
        "database": timedelta(hours=1),
4
        "github": timedelta(hours=2),
5
        "cloud_api": timedelta(minutes=30),
6
    }
7

8
    def get_credential(self, service, agent_id, session_id):
9
        # Generate scoped, short-lived token
10
        if service == "database":
11
            return self.generate_db_token(
12
                username=f"agent_{agent_id[:8]}",
13
                database="readonly",
14
                ttl=self.rotation_schedule["database"],
15
            )
16

17
    def revoke_session_credentials(self, session_id):
18
        for token in self.issued_tokens[session_id]:
19
            self.revoke_token(token)

Principle 5: Human-in-the-Loop cho Dangerous Actions#

1
APPROVAL_REQUIRED_TOOLS = [
2
    "deploy_production", "delete_user_account",
3
    "modify_billing", "grant_admin_access",
4
    "bulk_email", "database_migration",
5
]
6

7
async def request_approval(tool_name, params, agent_reasoning):
8
    # Send to approval queue
9
    # Wait 5 minutes for human response
10
    # If timeout → alert team, return False

Production Checklist#

Tiếp Theo#

Bài	Chủ đề
1	Prompt Injection & Defense
2	Tool Access Control (bài này)
3	MCP Server Security
4	Agent Auditing & Compliance
5	Production Security Patterns

Series: Agent Security 2026 — Production Patterns. Bài 2: Tool Access Control — least privilege cho AI agents.