VERITRAILBook Governance Baseline

IS — Integrity, Safety & Security

IS-11: Least-privilege tool access

Grant AI agents only the tools, scopes and data access required for their declared purpose; deny by default.

Priority critical · Owner: Platform Engineering / IAM

Where IS-11 sits among the 64 controls of the library.AO12AO-01 AI governance policy (critical)AO-02 Executive accountability and AI governance forum (critical)AO-03 AI roles, responsibilities and RACI (high)AO-04 AI risk appetite and tolerance (high)AO-05 AI literacy and role-based training (high)AO-06 Escalation paths and decision rights (high)AO-07 Regulatory and contractual obligations register (high)AO-08 Responsible AI principles and objectives (medium)AO-09 Third-party AI accountability (medium)AO-10 Prohibited and restricted AI use policy (critical)AO-11 Stakeholder engagement and feedback (medium)AO-12 Governance resourcing (medium)EI12EI-01 Enterprise AI inventory (system of record) (critical)EI-02 AI risk classification and tiering (critical)EI-03 Accountable owner per AI system (critical)EI-04 Intended purpose and context of use (high)EI-05 Model, prompt and component registry (high)EI-06 Data source and lineage registry (high)EI-07 Agent and tool registry (critical)EI-08 Third-party and vendor AI inventory (high)EI-09 Shadow AI discovery (medium)EI-10 Dependency and integration mapping (medium)EI-11 Inventory attestation and recertification (medium)EI-12 Use-case intake register (high)GL12GL-01 Intake triage workflow (high)GL-02 Pre-deployment risk and impact assessment (critical)GL-03 Risk-tiered approval gates (critical)GL-04 Change management and reassessment triggers (high)GL-05 Pre-release validation and testing (high)GL-06 Technical documentation (high)GL-07 Deployment conditions and go-live readiness (high)GL-08 Post-deployment monitoring (high)GL-09 Retirement and decommissioning (medium)GL-10 Exceptions and risk acceptance (high)GL-11 Vendor AI due diligence and contract controls (high)GL-12 Periodic review and recertification (medium)IS16IS-01 AI threat modelling (high)IS-02 Data governance and quality (high)IS-03 Privacy assessment and data minimisation (critical)IS-04 Sensitive data redaction and masking (critical)IS-05 Bias and fairness testing (high)IS-06 Safety and harm evaluation (high)IS-07 Accuracy and robustness testing (high)IS-08 Transparency and AI disclosures (high)IS-09 Human oversight design (critical)IS-10 Secure model and prompt supply chain (high)IS-11 Least-privilege tool access (critical)IS-12 Runtime guardrails and policy enforcement (high)IS-13 Human approval for high-impact actions (critical)IS-14 Prompt-injection and data-leakage testing (critical)IS-15 Kill switch and rollback (critical)IS-16 Rate, budget and resource limits (medium)SE12SE-01 Control testing programme (high)SE-02 Evidence repository and retention (high)SE-03 Governance metrics and leadership reporting (medium)SE-04 AI incident management and reporting (high)SE-05 Audit-ready evidence packs (high)SE-06 Corrective action and continuous improvement (medium)SE-07 Management review (medium)SE-08 Immutable action logging (critical)SE-09 Post-market monitoring plan (high)SE-10 Independent review and internal audit (medium)SE-11 Stakeholder transparency reporting (medium)SE-12 Model performance and drift monitoring (high)

At a glance

Pillar
IS — Integrity, Safety & Security
Priority
critical
Applies to
Agents and agentic workflows
Typical owner
Platform Engineering / IAM
VERITRAIL modules
Shield
Control library
v1.0.0

Evidence that demonstrates this control

Examples of records an assessor would expect to see. Until a named reviewer has examined them, evidence is labelled User-asserted or Missing evidence in VERITRAIL outputs, never Verified.

  • Tool permission matrix
  • Access-scope configuration
  • Access review records

Indicative framework mappings

FrameworkReferences
NIST AI RMFMEASURE 2.7, MANAGE 2.2
ISO/IEC 42001A.6.2.6, A.4.4
EU AI ActArt. 15, Art. 14

Framework mappings are indicative VERITRAIL interpretations to support governance readiness and evidence collection. They do not constitute legal advice, a certification, or a determination of conformity with ISO/IEC 42001 or compliance with the EU AI Act or any other law.

Where the self-assessment asks about it

  • SEC-Q2 — Are LLM applications and agents tested for prompt injection, jailbreak, data leakage, and unsafe tool use?

Related critical risk flags

  • Agents or LLM apps not tested for prompt injection and unsafe tool use — Agents with tool access that are untested for injection can be manipulated into unauthorised actions or data leakage.

Last reviewed: