# Least-Privilege Agent Starter

> Run an autonomous AI agent on your own hardware without handing it the keys to everything.

**Status:** Open source  
**Repository:** https://github.com/michaewahl/openclaw-least-privilege-starter

## Problem

Teams give autonomous agents broad standing access; the hard part isn't the model, it's the guardrails.

## What it does

An opinionated open-source starter for running an autonomous AI agent under real security guardrails, built after onboarding an AI "employee" on a local machine. It codifies five principles as adaptable templates: the agent gets its own isolated service account (its own identity, not an extension of yours), credentials scoped to the one job it does, advise-don't-act with a human approving anything irreversible, a lean always-on agent with disposable scheduled sub-agents for heavy work, and a written agent handbook defining scope and escalation before day one. Ships sanitized config, handbook, and security-setup templates.

## Measured results

- **5 principles** least-privilege defaults
- **Own identity** isolated service account — The agent is treated like a separate hire, never an extension of your credentials.

## Stack

Agent security, Least-privilege IAM, Isolated service accounts, YAML config templates, Self-hosted model endpoint

## Topics

AI, Agents, Security

---

Part of the proof-of-work portfolio of Michael Wahl — VP, Software Engineering & AI Enablement.

- Canonical project page: https://connect.michaelwahl.org/project/openclaw-least-privilege-starter
- Full professional profile: https://connect.michaelwahl.org/
- Machine-readable context: https://connect.michaelwahl.org/llms.txt