Least privilege
Last verified
Least privilege means a credential carries the minimum access required for its job.
Applied to AI APIs: a dashboard that displays spend needs read access, not the ability to delete keys. A production service needs inference, not organisation administration. A tool taking a full-scope admin key for a read-only feature is a design smell worth questioning.
It also argues for one key per consumer, so revoking one integration does not disrupt the others.