MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents

An agent connected to personal services may receive credentials that authorize more API methods than its task requires. Repeated approval of every call creates friction, but broad initial approval leaves unnecessary authority available if the model makes a mistake or processes an injected instruction.

MiniScope seeks mechanically enforceable permission selection without trusting the acting model. Its optimization is conditioned on the submitted execution plan and the service's method-to-scope mapping; it does not establish that the plan itself faithfully represents the user's intent.

A method for reconstructing permission hierarchies from the sets of API methods enabled by service scopes.

An integer linear programming formulation that selects a minimum-cost scope cover while accounting for permissions already granted.

A credential-isolating enforcement layer with session-aware approval, plus synthetic requests grounded in real API documentation.

During initialization, MiniScope collects each service's mapping from API methods to accepted scopes. Scopes enabling equivalent method sets can be grouped, and set inclusion establishes broader and narrower permissions. This derives relationships from actual method coverage rather than relying on scope names.

The agent submits an execution graph of tool calls and data dependencies. The solver separates calls by service and chooses scopes covering every required method. The paper's cost model reflects the number of methods authorized by a scope. Existing grants are fixed constraints when additional permissions are selected, so the solver minimizes additions without silently revoking earlier grants.

Users approve newly required permissions through options such as one-time, session, or persistent access. MiniScope stores the real service credentials separately from the agent and associates permissions with a session token. Each call is intercepted and checked before those credentials are attached. Temporary grants are discarded at session end, while persistent grants remain available under the selected permission model.

The dataset derives synthetic requests from documented APIs for mail, calendars, files, storage, messaging, meetings, and other services. It includes individual calls, multi-call requests, and combined-application workflows. Scope-selection baselines use language models; evaluation compares their selections with the optimization objective and examines overprivileged connector configurations.

Runtime experiments separate solver and checking costs from end-to-end agent latency and operational cost. A simulated sequence of recurring user requests compares confirmation frequency across permission models and user personas. This measures expected approval effort under the simulation, rather than reporting a deployed-user study or an adversarial robustness benchmark.