principle-least-privilegelisted

# Least Privilege Enforce a constraint by withholding the capability, not by asking for restraint. On a dispatch path the guarantee is the target's toolset, not the prose telling it to behave: a prompt does not rewrite an agent body, and an instruction never widens or narrows what a role can actually touch. **Why:** Prose gets forgotten; a missing Write tool does not. A constraint that is a property of the harness holds even when the model does not cooperate — and a role that cannot do the forbidden thing needs no rule against it. **Pattern:** - Reviewers hold no Write/Edit and run in plan mode. A reviewer that can fix what it found can approve its own fix. - A child process receives an environment allowlist and its own credential block — never another vendor's, never the parent's full environment. - Prefer the narrowest dispatch target that can run the errand. Where a governing rule demands a structural guarantee — a read-only lens — a target holding a command sink is refused whenever a narrower target can carry the errand, whatever else the wider one can do. When the narrowest available target still carries more than the errand needs, the errand rides on an explicitly scoped prompt, and the report says the guarantee is prompt-level, not structural. - Match the assurance claim to the mechanism: when work falls back to a full-tool context, say the guarantee no longer applies rather than keeping the claim while losing the mechanism.