An AI agent that can send emails, query databases, and execute code is a privileged insider — and like any insider, it should operate on a need-to-know basis. Classic security got this right decades ago: least privilege. Here's what that looks like when the "user" is a model with tools.
Step 1: Enumerate Capabilities as Bits
Give every capability a bit in a 64-bit mask: send emails (bit 0), generate code (bit 1), read DB (bit 2), write DB (bit 3), access PII (bit 4)… Roles become masks; users get the OR of their roles. The mask travels with the request — no prompt can change it.
Step 2: Gate Tools at Generation Time
If a user lacks the bit for a tool, don't wait for the tool call to fail — ban the tool's trigger phrases in generation. The model literally cannot produce send_email(. This is how reskSecure and ReskSafety do it: trigger phrases are compiled into the hard-block list alongside banned content.
Step 3: Verify After Generation
Defense in depth: a post-generation check (verify_tool_action()) re-validates every tool call against the caller's mask. Two independent layers, one assumption: the mask, not the prompt, is the source of truth.
Step 4: Audit Everything
Log every call — function, parameters, result — and stream it to your observability stack. ReskPoints ships this for agents; ReskSafety's console surfaces it per user.
See It Live
The hosted ReskSafety demo at demo.resk.fr lets you create roles with different capability masks and watch tool calls get blocked in real time.