An agent does more than generate text. It can send email, create records, modify data, or initiate payments. Agent security is therefore a permissions and operations design problem, not just prompt safety.
The principle of least privilege
An agent should not access every tool and data source. Permissions must be scoped by user role, task, and transaction risk.
Read and write access should be separated, with short-lived tokens, scoped APIs, and explicit audit logs for critical actions.
- Tool-level permissions
- Record and field-level access
- Short-lived, revocable credentials
Where is human approval required?
Approving every step makes automation useless, while approving none increases risk. Approval points should follow financial impact, reversibility, and customer impact.
The agent should present the intended plan and change clearly, then execute only within that approved scope.
Untrusted input and tool output
User text, retrieved documents, and tool output must be treated as untrusted data. Direct and indirect prompt-injection instructions must not override system policy, and external content must remain data rather than instructions.
Validate schemas, permissions, and outputs before using tool results. Restrict network egress to approved destinations, and block URLs, uploads, or secret requests that could enable data exfiltration.
Tracing and audit history
Production traces should capture model and prompt versions, tool names, permission decisions, approvals, and outcome status. Raw source data, access keys, tokens, and personal data should not be logged by default.
Redact logs before storage, minimize recorded data, and delete it after a defined retention period. Supply secrets through a secret manager using short-lived, narrowly scoped credentials.
Designing for failure
Agents operate with ambiguous inputs and changing tool states. Timeouts, partial success, duplicate actions, and conflicting data must be designed for from the start.
Idempotency, retry limits, and dry runs are core controls. Use rollback only when the tool supports it; manage irreversible side effects with human approval and compensating actions.
Key takeaways
- Give agents only the permissions required for the task.
- Keep untrusted content separate from instructions.
- Redact traces and limit their retention.