Least permission means a tool receives only the access required for its current job and no more. That rule is especially important when Oneira routes a compact request into a powerful agent. A small interface can still authorize a large action if the connected account is broad.
Classify the action before granting it
Read can expose information. Create can publish or spend. Update can overwrite. Send can contact other people. Delete can remove recovery options. Label each tool by its real effect, including hidden actions such as sharing a file or triggering a notification, then decide whether the job needs that entire class of access.
Narrow the resource and time window
Prefer one folder over an entire drive, one calendar over all calendars, one project over the whole organization, and an expiring token over a permanent key. Use test accounts when possible. A permission that was reasonable for setup should be removed when the experiment ends.
Confirm consequential actions outside the model
The final approval for a purchase, public post, message, access change, deletion, or legal submission should be explicit and bound to the exact target. Do not let the agent satisfy its own confirmation rule. Keep logs that show the request, proposed action, approval, tool call, and result.
The short version
- Judge a tool by its real external effect, not its friendly name.
- Limit resource scope, account scope, and credential lifetime.
- Require exact human approval for consequential writes.