Security and access
Least privilege
The rule of giving an assistant only the access it needs for a task and nothing more. For an ad account, that usually means read-only first.
Least privilege is the rule of granting an assistant only the access a task needs and nothing more. For an ad account it usually means a read-only role for reporting. For a store it means an API user or key limited to the objects in question, such as products but not customers. For payments it means a restricted key rather than a full-access one.
The rule limits damage in two directions. A wrong answer from the model, a misunderstood instruction or a prompt injection can only do what the connection allows. And a leaked credential from a local server is worth less to whoever finds it. Both matter more with MCP than with a dashboard, because the assistant acts on your behalf without seeing every step.
Applying it is mostly a matter of order: connect read-only first, run the questions you care about, verify the answers against the native interface, and only then add a write scope for one specific, supervised task. Document who connected what, with which access, so the setup can be reviewed and revoked.