ScopeMap: planning least-privilege permissions for AI agents

Description and use

ScopeMap is an educational demo that identifies the minimal permissions an AI agent needs for a task and exports a JSON plan.

Problem

Determining the minimal set of permissions an AI agent needs to perform a task while avoiding unnecessary or dangerous capabilities.

Outcome

ScopeMap successfully identifies over‑privileged capabilities, recommends a minimal set, and exports a structured plan, as verified by nine passing tests and a production build.

Workflow

• Select a synthetic workflow (document summary, support response, or CSV analysis).
• Choose capabilities from seven options (scoped file reading, broad file access, file writing, sending email, external network access, shell execution, persistent memory).
• ScopeMap analyzes the selection against the workflow’s requirements.
• It highlights missing requirements, unnecessary permissions, and provides reasons for each recommendation.
• Apply the recommended set or edit the human‑review checklist.
• Export or download the plan as JSON.

Evidence

I built ScopeMap, an educational permission‑planning demo, with AI assistance in Lovable. It compares a requested capability set with a small, explicit set of requirements for a fictional workflow.

Source

The analysis shows missing requirements, unnecessary permissions, and the fixed reason behind each recommendation.

Source

The Lovable build reported nine passing tests and a successful production build.

Source