Health Agent Permissions: A Least-Privilege Checklist for Sensitive Data

Start from least privilege and short duration

Least privilege means granting only the data and operations required for the current task. A daily wellness-summary agent may need read access to a person's latest analysis and action plan; it does not need billing, deletion, or access to another user in the organization.

Grant capabilities at the operation level

Scope by subject first: user and organization. Then scope by capability: read, write, connection, export, deletion, and paid operations. Finally scope by endpoint so a token cannot call a broad category of routes simply because it can call one safe one.

Use expiration, audit logs, and a clear revoke path. Test negative cases: an agent should not be able to read another tenant, send a payment, or create a data export merely because a developer assumed an internal check would catch it.

Build a capability matrix

List every operation as a row and every agent role as a column. Mark read, create, update, share, pay, export, and delete separately. Add the resource boundary and approval requirement. This matrix becomes the source for scopes, endpoint grants, UI copy, and tests.

Avoid scopes such as health.all. A daily briefing agent may need health_context.read and dashboard_links.create for one user. It does not need raw genome download, account administration, billing, or provider OAuth management.

Make approval understandable

The approval screen should name the agent, developer, requested capabilities, data categories, duration, and any payment authority. Use concrete verbs such as read recent labs or create an expiring dashboard link. Let the user reject individual optional scopes where the workflow supports it.

After approval, show active agents with last use, expiration, scopes, and a revoke control. Revocation should take effect immediately and should be covered by an automated test.

• Who is requesting access?
• Whose data and which organization?
• Which exact operations?
• For how long?
• What requires a second confirmation?

Least-privilege test cases

• Another user's resource returns a safe authorization error
• Another organization's resource cannot be inferred or accessed
• A revoked or expired token fails on the next request
• An ungranted endpoint is absent or denied
• Paid and destructive operations require separate authority
• Audit logs identify the agent and resulting resource

Carry user and organization boundaries through every call

WellNizz's agent identities carry user, organization, scopes, and optional endpoint grants. The product separates normal analysis access from billing and deletion permissions, and its APIs return structured errors when a tool or scope is not allowed.

Require deliberate approval for irreversible actions

Permissions are one part of safety. Teams must still secure clients, validate model output, minimize retained data, and meet the privacy and regulatory obligations relevant to their deployment.