Threat model
Start with one question: what is the worst this agent could do if it followed a bad instruction? The answer sets the protection level. An agent that tags inbound messages carries limited risk; an agent that can issue refunds and read every customer record is a different proposition entirely. Security is built around capability to act, not around how smart the system is.
Least privilege
- Give each tool the narrowest scope: read-only wherever possible, writes limited to required fields.
- Separate permissions across agents: whoever reads sensitive data should not hold an external send channel.
- Set quantitative ceilings: message counts, refund amounts, records modified per session.
- Review permissions periodically and remove anything never actually used.
Data and privacy
An agent needs data to be useful; the question is how much and when. The working rule is to retrieve the minimum sufficient for the current task rather than loading everything just in case: this customer's record only, the policy relevant to this case only. Add masking for fields the agent never needs — card numbers, national IDs — and set explicit retention periods for logs.
Prompt injection
The risk most specific to agentic systems is external text — a customer message, file content, a web page — carrying something that reads like an instruction: "ignore the above and do X". The remedy is not cleverer wording alone, it is architecture:
- Treat all external content as data; never let it widen the agent's permissions.
- Keep sensitive tools off the paths that ingest untrusted content.
- Put a human approval on any irreversible action derived from external content.
- Test with written attack scenarios as part of acceptance testing, not after launch.
Logs and accountability
| What to log | Why |
|---|---|
| Every tool call and its result | Reconstruct exactly what happened after an incident |
| Key inputs behind a decision | Know on what basis the action was taken |
| Human approvals | Accountability and compliance |
| Escalations and their reasons | Tune boundaries and thresholds later |
| Failures and retries | Spot patterns before they become incidents |
Pre-launch checklist
- Has the worst-case scenario been written down and structurally prevented?
- Is every tool narrowly scoped and reviewed by the owner of that system?
- Are irreversible actions behind human approval?
- Is external content treated as data on every path?
- Are logs complete, exportable, and governed by a retention period?
- Is there a named owner who can stop the agent immediately?