Everyone is racing to give AI agents more power. More tools, more plugins, more skills, one-click "install this capability." I think that's the wrong race.
The hard problem is giving it less. Precisely less. Only what this agent, on this team, needs to do its job. Nothing else. That's the problem that decides whether you can actually let an agent run without a human babysitting it.
That's not a new idea. Security people have called it least privilege for forty years. What's new is that almost nobody applies it to agents. We hand a fresh agent the entire toolbox, plus a pile of third-party instructions, and hope it behaves.
The question isn't "what can we let this agent do?" It's "what is the least we can grant and still get the job done?" That inversion is the whole discipline.
Two principles we build on instead. We just shipped both into TapPass.
1. Least privilege, for capabilities and for instructions
An agent should only be able to use the tools and the skills you've granted it. Everything else is denied by default, including tools and plugins it discovers later. Deny-rest, not allow-all.
Most people, if they do this at all, do it for tools. But the part that gets missed is instructions. A "skill" is imported behaviour. It's the instruction text a plugin ships, and it steers your agent without ever appearing as a tool call. A malicious or sloppy skill can redirect an entire agent while every individual action it takes looks perfectly compliant.
So instructions need the same discipline as tools, and it splits into two separate questions:
- Is it safe? Reviewed by a human, and unchanged since. If the text drifts, that's the same rug-pull risk as a tool quietly rewriting its own definition.
- Is it allowed? Granted to this agent or this team, not made globally available to everything.
Two questions, two controls. Conflate them and you get "I approved it, so it's live everywhere," which is how you end up with authority you can't account for.
2. Progressive authority: agents earn scope, they don't get handed it
You don't give a new hire root access on day one. Same for agents.
Every grant should start in watch mode: recorded, not enforced. You see what the agent actually does with the capability, on real traffic, before it can block anything. Then you turn on enforcement. Authority is tightened into place over time, with a human in the loop. It isn't surrendered up front and clawed back after an incident.
This matters because of what the alternative does. Lock everything down on day one and that's exactly why governance gets ripped out. It breaks things, people disable it, and you're back to allow-all. Watch-first means the control earns trust before it bites.
Why now
The industry just standardized how to package agent capability. Google's Agent Plugins is a reasonable format for shipping skills and tools together. But it explicitly ships no permission model and no trust verification. That part is "delegated to the client."
That delegated half is the authority layer, and it's the whole game:
Approve means "this is safe and available." Grant means "this agent may use it." A plugin is the bundle you grant in one gesture.
That's the difference between "we scanned your plugins" and "you decide exactly who gets which skill, per team and per agent, and can prove it." The race to give agents more is easy; anyone can install a capability. The discipline of giving them precisely less, then earning up from there, is what makes an agent you can actually let run.