 For example, an LLM- based app may need to write some output to a file.  If this were implemented using a plugin to run a shell function then the scope for undesirable actions is very large (any other shell command could be executed).  A more secure alternative would be to build a file-writing plugin that could only support that specific functionality Limit the permissions that LLM plugins/tools are granted to other systems the minimum necessary in order to limit the scope of undesirable actions.  For example, an LLM agent that uses a product database in order to make purchase recommendations to a customer might only need read access to a 'products' table; it should not have access to other tables, nor the ability to insert, update or delete records.  This should be enforced by applying appropriate database permissions for the identity that the LLM plugin uses to connect to the database Track user authorization and security scope to ensure actions taken on behalf of a user are executed on downstream systems in the context of that specific user, and with the minimum privileges necessary