Why is it risky to give an agent a broadly scoped token?
Why B is the answer
A prompt injection or mistake can reach everything the token allows
Least privilege limits the damage from errors and malicious input. Tool permissions should match the task.
In detail
- A prompt injection or a mistake can reach everything the token allows.
- Narrow scope limits that damage.
- Prefer short-lived tokens where you can.
Use case
An illustrative scenario, not a real incident.
An agent holds a token that reaches every repository. A prompt injection in an issue could use all of it. A narrow token limits the damage to one repository.
See it in different ways
mindmap
root((Agent limits))
Identity
Write access to trigger
Repository
One branch
Branch protection
Tools
MCP allow list
Tool permissions
Network
Firewall allowlistmindmap
root(("Token scope"))
n1["Broad"]
n2["Everything is reachable"]
n3["Narrow"]
n4["One repository"]
n5["Few permissions"]Key point: A token's scope is the size of the damage.
Why the other options are wrong
- A. A broad token makes each of the agent's requests run more slowly
- Token scope does not change speed.
- C. A broad token stops the agent from opening any pull requests
- A broad token can still open pull requests.
- D. A broad token uses up the premium requests much more quickly
- It does not change how premium requests are used.