Give each agent exactly what its job needs. Nothing more.
Scope is least-privilege for agents. Define the capabilities as a reusable role, apply it across the fleet, and keep everything you didn't grant completely invisible — the agent can't call or even see a tool it wasn't given.
Capabilities are a privilege, not a default.
Most agent stacks hand over a raw API key — every tool, all the time. Scope inverts that: an agent gets a deliberate, auditable surface and nothing else.
Least privilege by default
New agents start with zero capabilities. You add surface deliberately, one tool at a time.
Invisible, not just denied
Ungranted capabilities are hidden from the agent's tool manifest — closing the prompt-injection door before it opens.
Roles, not snowflakes
Govern by job function. One change to a role updates every agent that wears it — no per-agent drift.
One grid, the whole org's agent permissions.
Rows are roles, columns are capabilities. A glance tells you who can move money, who can touch production, and who can only read.
access-matrix · production
5 roles · 6 capabilities| Role | mail_send | payments_pay | vault_get | crm_read | crm_delete | deploy |
|---|---|---|---|---|---|---|
| Support · L2 | ||||||
| Billing | ||||||
| Ops · deploy | ||||||
| Read-only | ||||||
| Admin |
Illustrative matrix. granted · not granted (invisible to the agent)
Edit a role; every agent wearing it updates.
No code, no key rotation. Toggle a capability and the change propagates across the fleet on the next action.
mail_send
Send mail to approved domains
crm_read
Read CRM records (no PII export)
vault_get
Read secrets from the vault
payments_pay
Initiate payments
crm_delete
Delete CRM records
Applies to 12 agents
Publish roleWhat the agent sees
With vault_get off, that tool never appears in the agent's manifest. A prompt-injected request to "reveal the API key" has no tool to call.
// agent.tools (resolved)
[ "mail_send", "crm_read" ]
vault_get · payments_pay · crm_delete
→ not exposed
From zero to a governed agent in four steps.
Define a role
List the exact capabilities the job needs — mail_send, crm_read — and nothing else. Roles are version-controlled and reviewable.
Assign it to agents
Apply the role to one agent or a hundred. The agent inherits exactly that surface; changes to the role propagate instantly.
Everything else is invisible
Ungranted tools don't appear in the agent's tool list at all. It can't call — or even discover — what it wasn't given.
Adjust without redeploy
Tighten or widen a role in the console. No code change, no key rotation, no agent restart.
Put every agent your company runs under one policy.
Watch HiveKey scope, guard, and block a live action on your own agents — 30 minutes, no slides, no commitment.