A transit ops Claude tool connects to GTFS data. Which privilege model fits?

Running least-privilege service accounts with read-only GTFS access is the privilege model that fits transit ops tools connected to Claude. That model works because schedule lookup for rider or ops assistance rarely needs write or admin rights; read-only GTFS limits blast radius if the agent is prompt-injected or a tool call is abused. Least privilege and dedicated service identities also improve auditability compared with reusing vehicle telemetry write credentials for GTFS feed reads. Assigning schedule editor roles for routine GTFS timetable sync checks fails because it grants edit rights to timetable data that a read-only assistant never needs, expanding the attack surface beyond simple schedule lookups. Reusing vehicle telemetry write credentials for GTFS feed reads fails because it borrows write authority from an unrelated system and breaks least-privilege attribution for feed lookups. Allowing dispatcher case management permissions for GTFS lookups fails because case-management rights extend far beyond read-oriented ETA or schedule assistance and give the tool access to operational workflows it should not touch. Exam caveat: some ops workflows eventually need controlled writes (for example, drafting alerts); those should be separate tools with stronger hooks, not bolted onto the read-only GTFS identity. Operational check: provision a Claude-specific service account with read-only GTFS scopes, ban reusing vehicle telemetry write credentials for GTFS feed reads, review IAM quarterly, and alert on any attempted write or delete from the schedule tool identity.