ScopeMap: planning least-privilege permissions for AI agents

Description and use

ScopeMap is a demo that plans least‑privilege permissions for AI agents, showing how to identify necessary and unnecessary capabilities for given tasks.

Problem

Determining the minimal set of permissions an AI agent needs to perform a specific task while avoiding unnecessary or risky capabilities.

Outcome

ScopeMap successfully identifies over‑privileged capabilities, recommends a minimal set, and exports a structured JSON plan. Nine tests passed and a production build was verified.

Workflow

• Select a synthetic workflow (document summary, support response, or CSV analysis).
• Choose capabilities from a list (scoped file reading, broad file access, file writing, sending email, external network access, shell execution, persistent memory).
• ScopeMap analyzes the selection against workflow requirements.
• It highlights missing requirements, unnecessary permissions, and provides reasons for each recommendation.
• The user can apply the recommended set, edit a human‑review checklist, and export the plan as JSON.

Evidence

ScopeMap recommends the scoped read capability and explains why the other permissions are unnecessary for this particular scenario.

Source

The Lovable build reported nine passing tests and a successful production build.

Source

ScopeMap is a rule‑based educational planner, not a live AI model, security scanner, sandbox, or permission‑enforcement gateway.

Source