Recommended Free Tools
An AI agent can affect only the systems and data its identity and connected tools let it reach—but broad or inherited access can make that reach much larger than the task requires. Reduce the potential blast radius by giving each agent an accountable identity, limiting its effective permissions, checking authorization for each consequential action, and making access quick to trace and revoke.
A system prompt can describe boundaries, but it does not enforce them. Microsoft’s identity and shared-responsibility guidance calls for deterministic identity, authorization, and tool controls outside the prompt.
As an Amazon Associate I earn from qualifying purchases.
What determines an agent’s blast radius?
Follow authority through the whole workflow: the agent’s identity, its credentials, the tools and plugins it can invoke, and the permissions those tools carry into APIs and downstream services. The practical question is not just what the agent is instructed to do; it is what each available identity and tool can actually do.
Microsoft’s Least privilege for AI agents (agentic identities + RBAC) warns: “Without a first-class identity model, explicit scoping, and enforceable authorization checks, agents might accumulate excessive permissions, operate outside intended boundaries, or create unclear accountability for actions taken.” That is implementation guidance, not a measured estimate of how much any particular control reduces incidents.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How should you map and scope an agent’s authority?
Give every agent an accountable identity
Assign a distinct identity to each agent rather than relying on a shared account or borrowed human credentials. Record an accountable owner or sponsor, the agent’s purpose, approved data access, dependencies, and operating environment. A unique identity makes it possible to attribute activity and manage the agent through its lifecycle.
Map effective access, not just the agent’s direct role
Inventory the agent’s tools, plugins, data sources, APIs, identities, and downstream services. Then map what it can do on each resource, including permissions inherited through roles or granted by connected systems. A narrow-looking agent role does not guarantee narrow access if a tool can act with broader authority.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Grant only the resources and actions required for the task. Where the deployment platform supports them, prefer scoped, short-lived credentials and managed or federated workload identity, or certificates, over long-lived client secrets. Check the platform’s current instructions before choosing or configuring an identity method; these options are not available or appropriate in every environment.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do you control what an agent can do?
Authorize consequential tool calls against the initiating principal, the exact action, and its target. A permission check at the start of a session does not establish that every later action—or every target selected later—is authorized. Use allowlists to restrict available actions, and require fresh approval or time-bound privilege elevation for sensitive operations such as deleting, exporting, purchasing, deploying, sending information externally, or changing permissions.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft’s Identity, Access, and Least Privilege guidance recommends fresh approval for high-impact operations. Its AI agent shared responsibility model also assigns customers responsibility for authorizing actions, overseeing agents, auditing activity, and applying per-action checks. Adapt those recommendations to the actual platform and organizational risk model.
Compare the control patterns
| Control area | Broader pattern | More constrained pattern |
|---|---|---|
| Identity | Shared or borrowed credentials | Unique agent identity with an accountable owner |
| Authorization | Broad standing permissions | Task-, resource-, and action-scoped permissions |
| Credentials | Long-lived secret | Scoped short-lived token, managed or federated identity, or certificate where supported |
| Tool actions | Unrestricted invocation | Allowlisted action with a per-action check and approval or time-bound elevation when needed |
| Containment | Access that is difficult to isolate or trace | Ability to disable, revoke, and trace access across downstream systems |
These are design alternatives described in Microsoft’s identity and agent-security guidance, not a universal ranking. Their suitability depends on the deployment and on whether downstream services enforce the intended scope.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How can you make an incident containable?
Log enough context to reconstruct an action
For decisions and tool invocations, retain the principal, permission scope, action, resource, correlation information, and any relevant “on behalf of” user. This context helps establish who or what initiated an operation and which authority it used.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Exercise the full revocation path
Test disabling an agent identity, invalidating its tokens, rotating or revoking its credentials, removing unused grants, and confirming that downstream systems enforce the change. An account-level disablement alone is not a containment test if a connected service can still honor existing credentials or permissions.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Isolate components and manage their lifecycle
Treat models, plugins, tools, and data sources as part of the security boundary. Microsoft’s Reduce risk in autonomous agentic AI systems recommends isolation to limit cascading failures, alongside inventory, ownership, least privilege, lifecycle review, and decommissioning. Revisit access when the workflow, tools, data scope, or deployment environment changes.
What remains an open design question?
NIST NCCoE’s concept paper Accelerating the Adoption of Software and AI Agent Identity and Authorization, published in February 2026, raises practitioner questions rather than establishing a universal standard. They include how to apply least privilege when an agent’s required actions may not be predictable at deployment, how to issue, update, and revoke keys, how to prove authority for a particular action, how to delegate authority in “on behalf of” situations, and how to limit prompt-injection impact.
Those questions point to areas where deployment-specific controls and governance matter; the concept paper should not be read as settling them. Microsoft Entra Agent ID documentation also describes product-specific authorization restrictions, including safeguards on certain high-privilege directory roles. Such restrictions are not properties of every agent framework, so verify current product behavior and role support before relying on them.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow can teams measure whether controls are in place?
Microsoft suggests operational indicators such as the share of production agents with unique identities and owners, the share with scoped roles, audit-field coverage, and time to revoke an identity. These are suggested implementation metrics, not published security-outcome figures. The reviewed guidance provides no measured percentage reduction in agent incidents or blast radius attributable to these controls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
