Free to read · no account needed

10 min · plugins

Least-privilege checklist for tools

Goal: Default-deny every tool; open only the read/write/send/delete you need—send and delete last.

Best for: before enabling MCP servers, plugins, or connectors for real data.

Least privilege means: start with read, one folder, one account, no send/delete. Widen only when a real task fails without it—and write down why.

Print this checklist (or keep it in your notes) and run it every time you click Connect.

Why beginners skip this

Checking every permission at once feels easy—one misfire can touch tools it should never reach. Minimum privilege first.

Step 1 — Default deny sheet

For each tool ask read / write / send / delete; default all no, then open only the yes you need.

Tool: [name]
Job: [job]
Fill a table: Read/Write/Send/Delete = Yes/No with one-line why each.
Prefer beginner-safe defaults.
Example

Filled prompt

Connector: Drive read + Drive write + Calendar write enabled since onboarding.
Apply least-privilege checklist. I have not used Calendar write in 14 days.
Propose what to revoke and what to keep on ask-every-time. No allow-all language.

What good output looks like

  • Write stays No unless creating one summary file in sandbox
  • Send/Delete never for this job
  • Folder scope named

Step 2 — Time-box any wide access

If you must widen temporarily (launch week, migration), set a calendar reminder to revoke in 7 days. Put the reason in one sentence.

Draft a 7-day temporary access note: what was widened · why · revoke date · owner name.
Example

Filled prompt

GitHub connector: contents write + actions write; I only summarize PRs.
Revoke writes. Keep read. Ask-every-time if write ever returns.

What good output looks like

  • Read/draft preferred over write for “give each tool the smallest access that still does”
  • Ask-every-time on leave-the-system tools
  • Kill-switch owner named
  • Pass/fail: dry-run only today

Step 3 — Quarterly prune (10 minutes)

List connectors/plugins; remove unused; shrink scopes that grew “give each tool the smallest access that still does” Test disconnect once so you remember how.

Write a 10-minute quarterly prune checklist for AI connectors/plugins a beginner can follow click-by-click.
Example

Filled prompt

Job: Connect/review scopes for “give each tool the smallest access that still”. Prefer read/draft. Ask-every-time on leave-the-system.
Boundaries: draft only; Unknowns [?]; no silent send; no invented metrics.
Return: checkable artifact + one-minute pass/fail for mcp-least-privilege-checklist.

What good output looks like

  • Matches named constraints for “give each tool the smallest access that still does”
  • Unknowns labeled; no invented owners/metrics
  • Stops before irreversible actions
  • Pass/fail markable in ≤60s

Save this card

Card: Default deny every tool; open only the read/write/send/delete you actually need. Keep this beside the tool; read before you start.

Before you start

Open the MCP panel on the account you keep. For “give each tool the smallest access that still,” decide read/draft vs write before any Connect. Ask-every-time on leave-the-system. Guide: mcp-least-privilege-checklist. Keep the real job visible the whole time; a blank box means stop and fetch the artifact first.

How to use this week

This week run the least-privilege checklist on a real MCP: enable only tools needed this week; out-of-ring actions need human confirm.

Close the week by quoting aloud the refuse line you actually used once. If you cannot, rerun Practice now and date the pass/fail (Asia/Shanghai).

Monthly 8 minutes

Calendar a recurring 8-minute permission skim. Unused writes get revoked the same day—not “give each tool the smallest access that still does”

Keep it real

Run this guide’s Practice now on work you will actually ship this week—not a fictional scenario. Dated notes beat perfect theory.

Do not bookmark-only

Finish Practice now, then tick this guide on your path. Titles unread are not skills.

Close the loop

Write one line: next time I check every permission at once, I refuse go.

Check the unknown path

What should the model do when a field is missing—null, TBD, or ask you? Write it once in Boundaries.

Red flag

Default-allow tools; unused write/send still open—default deny and close extras.

Pitfalls

PitfallFix
Admin forever for convenienceTemporary + revoke date
Same token for personal and workSeparate accounts
No written why for wide scopesOne-sentence note
Example

Filled prompt

Temptation: skip the habit for mcp-least-privilege-checklist to save five minutes.
Job still: give each tool the smallest access that
Smallest correct pass: Done visible · checkable artifact · Unknowns [?].
Boundaries: draft only; no silent send; no invented metrics.
Return: artifact + refuse-line said aloud.

What good output looks like

  • Names the shortcut refused (specific to mcp-least-privilege-checklist)
  • Still delivers checkable output for “Least-privilege checklist for tools”
  • Unknowns labeled; draft-only
  • Pass/fail: refuse-line dated (mcp-least-privilege-checklist #4)

Practice now

Deny log: log each denied permission with why (Asia/Shanghai).

Time-box grant: temporary grant expires Asia/Shanghai tonight (Asia/Shanghai).

Scope shrink: replace one broad scope with a narrower one (Asia/Shanghai).

Revoke-one drill: remove one tool you did not use today (Asia/Shanghai).

Least-privilege drill: revoke one unused MCP tool scope tonight; note it on Save (Asia/Shanghai).

Thin-spot drill: rewrite the Save card with real nouns from your work (repo, doc, inbox). Generic placeholders fail the drill.

Tonight for one real MCP connection enable only tools needed this week; turn extras off and log why.

Reality check: after Practice now, write one sentence you will refuse next time—and keep it on the Save card dated Asia/Shanghai.

Today card (copy) — mcp-least-privilege-checklist: 1. Artifact I will produce: ___ 2. Pass/fail check: ___ 3. Refuse-line if tempted to skip verify/send: ___ (date: Asia/Shanghai) 4. One never-do from this guide: ___

Extra pass: do the card on a real file today—reading alone does not count.

One sentence takeaway

Minimum privilege first; out-of-ring actions always need human confirm.

Word-floor practice

Run the Today card once on a real artifact. Write pass/fail + never-do with date Asia/Shanghai. If you only skimmed, do not mark this guide done.

Next

Tools and approvals · Drive, mail, calendar

← Back to home · Learn · Tools · Compare · Start