Agent systems: service account least privilege

By Michael Samuel Naeem · June 21, 2026 · 6 min read

Agent systems: service account least privilege means you keep agent side effects idempotent around service account least privilege — with a named owner, a measurable signal, and a rollback a tired on-call can run. I reach for this when on-call already feels weekly pain here; that is also when shortcuts like copying a tutorial without matching production constraints start paging people.

This write-up is specific to agent-service-account-least-privilege in a agent context, using Temporal, OpenTelemetry, Postgres for the mechanics while keeping ownership human.

Fitting Agent systems: service account least privilege into an existing system

Agent loops amplify mistakes: one bad tool call can fan out across systems. For agent service account least privilege, that means making failure visible early.

With Temporal, OpenTelemetry, Postgres, the mechanics are straightforward; the hard part is invariants. The anti-pattern I still see is copying a tutorial without matching production constraints.

Document what 'success' and 'undo' mean in product language. Future reviewers will not share your context on agent service account least privilege.

Slug-specific note (agent-service-account-least-privilege): prioritize privilege behavior under load and verify with a fixture named agent-service-account-least-privilege-smoke.

Contracts and ownership boundaries

Agent loops amplify mistakes: one bad tool call can fan out across systems. For agent service account least privilege, that means making failure visible early.

With Temporal, OpenTelemetry, Postgres, the mechanics are straightforward; the hard part is invariants. The anti-pattern I still see is copying a tutorial without matching production constraints.

Ship behind a flag, canary by cohort, and write the rollback in the PR description. Agent systems: service account least privilege that needs a hero is not done.

Concretely, being able to keep agent side effects idempotent around service account least privilege forces explicit choices: source of truth, timeout budgets, and which errors users see versus operators.

Slug-specific note (agent-service-account-least-privilege): prioritize privilege behavior under load and verify with a fixture named agent-service-account-least-privilege-smoke.

# Agent systems: service account least privilege
from dataclasses import dataclass

@dataclass(frozen=True)
class AgentServiceAccounRequest:
    tenant_id: str
    idempotency_key: str

async def run_agent_service_account_le(req, deps) -> None:
    if await deps.store.seen(req.idempotency_key):
        return
    with deps.tracer.start_as_current_span("agent-service-account-least-privilege"):
        await deps.client.execute(req, timeout=2.0)
    await deps.store.mark(req.idempotency_key)

State, storage, and retention

I treat Agent systems: service account least privilege as an operations problem first. The goal is to keep agent side effects idempotent around service account least privilege, not to collect frameworks.

Keep side effects at the edges and make every write idempotent. Agent systems: service account least privilege without retry semantics is a future incident write-up.

Document what 'success' and 'undo' mean in product language. Future reviewers will not share your context on agent service account least privilege.

My never-again list for agent service account least privilege: copying a tutorial without matching production constraints; shipping without a kill switch; and alerting only on infrastructure CPU.

Slug-specific note (agent-service-account-least-privilege): prioritize privilege behavior under load and verify with a fixture named agent-service-account-least-privilege-smoke.

Security defaults that are non-negotiable

I treat Agent systems: service account least privilege as an operations problem first. The goal is to keep agent side effects idempotent around service account least privilege, not to collect frameworks.

With Temporal, OpenTelemetry, Postgres, the mechanics are straightforward; the hard part is invariants. The anti-pattern I still see is copying a tutorial without matching production constraints.

Document what 'success' and 'undo' mean in product language. Future reviewers will not share your context on agent service account least privilege.

Review prompts I use: what happens twice, what happens never, what happens partially? If Agent systems: service account least privilege cannot answer, it is not production-ready.

Slug-specific note (agent-service-account-least-privilege): prioritize privilege behavior under load and verify with a fixture named agent-service-account-least-privilege-smoke.

SLOs and dashboards

I treat Agent systems: service account least privilege as an operations problem first. The goal is to keep agent side effects idempotent around service account least privilege, not to collect frameworks.

Keep side effects at the edges and make every write idempotent. Agent systems: service account least privilege without retry semantics is a future incident write-up.

Acceptance check: an on-call engineer can explain system state for agent service account least privilege from one dashboard and one runbook page.

Slug-specific note (agent-service-account-least-privilege): prioritize privilege behavior under load and verify with a fixture named agent-service-account-least-privilege-smoke.

Related reading:

• webhooks reliable delivery
• idempotency distributed systems
• designing for observability slos

First-week validation plan

I treat Agent systems: service account least privilege as an operations problem first. The goal is to keep agent side effects idempotent around service account least privilege, not to collect frameworks.

With Temporal, OpenTelemetry, Postgres, the mechanics are straightforward; the hard part is invariants. The anti-pattern I still see is copying a tutorial without matching production constraints.

Ship behind a flag, canary by cohort, and write the rollback in the PR description. Agent systems: service account least privilege that needs a hero is not done.

Slug-specific note (agent-service-account-least-privilege): prioritize privilege behavior under load and verify with a fixture named agent-service-account-least-privilege-smoke.

Practical defaults for Agent systems: service account least privilege

I treat Agent systems: service account least privilege as an operations problem first. The goal is to keep agent side effects idempotent around service account least privilege, not to collect frameworks.

With Temporal, OpenTelemetry, Postgres, the mechanics are straightforward; the hard part is invariants. The anti-pattern I still see is copying a tutorial without matching production constraints.

Acceptance check: an on-call engineer can explain system state for agent service account least privilege from one dashboard and one runbook page.

Slug-specific note (agent-service-account-least-privilege): prioritize privilege behavior under load and verify with a fixture named agent-service-account-least-privilege-smoke.

After a month, delete unused flags and dual paths. agent-service-account-least-privilege accumulates temporary bridges faster than teams expect.

Review questions before merging agent service account least privilege work

Agent loops amplify mistakes: one bad tool call can fan out across systems. For agent service account least privilege, that means making failure visible early.

With Temporal, OpenTelemetry, Postgres, the mechanics are straightforward; the hard part is invariants. The anti-pattern I still see is copying a tutorial without matching production constraints.

Acceptance check: an on-call engineer can explain system state for agent service account least privilege from one dashboard and one runbook page.

Slug-specific note (agent-service-account-least-privilege): prioritize privilege behavior under load and verify with a fixture named agent-service-account-least-privilege-smoke.

After a month, delete unused flags and dual paths. agent-service-account-least-privilege accumulates temporary bridges faster than teams expect.

Field notes after thirty days of agent service account least privilege

I treat Agent systems: service account least privilege as an operations problem first. The goal is to keep agent side effects idempotent around service account least privilege, not to collect frameworks.

Keep side effects at the edges and make every write idempotent. Agent systems: service account least privilege without retry semantics is a future incident write-up.

Ship behind a flag, canary by cohort, and write the rollback in the PR description. Agent systems: service account least privilege that needs a hero is not done.

Slug-specific note (agent-service-account-least-privilege): prioritize privilege behavior under load and verify with a fixture named agent-service-account-least-privilege-smoke.

After a month, delete unused flags and dual paths. agent-service-account-least-privilege accumulates temporary bridges faster than teams expect.

Resources

• Internal runbook seed: agent-service-account-least-privilege
• https://12factor.net/
• https://martinfowler.com/