Before an AI agent goes live, verify that it can access only what its task requires, that important actions pass through independent authorization and approval checks, and that a person can stop it without relying on the agent. Use the checklist below at launch and repeat it after material changes to prompts, tools, permissions, memory, retrieval, models, or orchestration.
1. Map what the agent can access and change
Start with the agent’s effective authority—not the capabilities its prompt says it should use. Compare what the task requires with what its tools, credentials, and downstream systems actually permit. OWASP’s Excessive Agency guidance describes the risk of a document-reading extension whose downstream identity can also update or delete records, or a broadly privileged identity acting across user boundaries.
As an Amazon Associate I earn from qualifying purchases.
Inventory tools, identities, and reachable systems
- List every tool, connector, API, data source, credential, reachable system, and downstream action available to the agent.
- For each capability, record whether it can read, write, send, delete, deploy, or purchase—and which resources, users, or tenants it can affect.
- Remove unused functions. Replace open-ended tools with narrower operations wherever practical.
- Compare the task’s required access with the extension’s and credential’s actual authority. Separate read and write access when the task does not need both.
Constrain identity and permissions
- Give each agent only the capabilities needed for its assigned task. Prefer user-bound or delegated identity over a broad, shared service identity when the deployment supports it.
- Scope permissions to the tool, operation, resource, user or tenant, and task duration. Prefer short-lived, task-bound credentials over standing credentials, and make revocation practical.
- Enforce authorization in the backend for every action. Validate the tool, schema, arguments, actor identity, tenant or session scope, and resource access before execution.
- Reauthorize if the agent’s scope expands or its execution context changes. A prompt instruction is not an access-control boundary.
- Treat retrieved webpages, documents, email, memory, and tool output as untrusted input. Keep policy boundaries outside the agent’s ability to change.
- Set explicit limits for loops, steps, retries, request rates, and cost.
2. Put independent checks in front of consequential actions
Decide in advance which actions may run autonomously, which need extra validation or a preview, and which require human authorization. Classify risk by impact, reversibility, affected people or data, external visibility, and potential blast radius. The model can propose an action; a separate policy or execution component should decide whether it is authorized to run.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchMake approval specific to the action
- For high-impact or irreversible actions, bind approval to the requester and agent identity, tool, target, normalized parameters, execution context, and expiry. Use single-use approval where possible.
- Have the executor independently check the exact action and current authorization. An approval for different parameters—or a confident model response—is not sufficient.
- Decide how to handle missing or late human responses. OWASP AISVS calls for fail-closed blocking when approval is not satisfied within the defined time.
- Fail closed if risk classification, policy checks, approval validation, or audit logging is unavailable.
- Use idempotency where possible. If duplicate execution remains possible, require an explicit confirmation or provide another safeguard against unintended repeats.
The OWASP AI Agent Security Cheat Sheet puts the execution boundary plainly: “The execution component must still check the actor’s authorization and any required approval for the exact action.”
#1 Best Overall
3. Monitor actions and control failures
Monitoring should make it possible to reconstruct what happened, who or what initiated it, which controls applied, and what the downstream system did. Record denied calls as well as successful ones; attempted misuse can be as important to an investigation as completed work.
Capture enough context to investigate
- Record the actor, agent instance and session, tool and target, relevant parameters, effective permission state, policy version, risk classification, approval identifier and outcome, execution result, and timestamps.
- Connect agent events to existing security monitoring and incident-response processes so that unusual activity is not isolated from the rest of the environment.
- Redact credentials and minimize sensitive information in logs. Preserve enough context for investigation without turning the audit trail into an unnecessary copy of protected data.
- Define alert owners and the response each alert can trigger: pause the workflow, revoke credentials, block a tool, require a human checkpoint, or activate shutdown.
Alert on behavior that may signal misuse
- Permission expansion attempts or use of a tool more powerful than the task requires.
- Unusual invocation frequency, abnormal loops or cost, or repeated approval failures.
- High-impact actions outside expected patterns, attempted approval bypass, or suspected data exfiltration.
- Missing, incomplete, or inconsistent identity, permission, approval, or execution records.
Test the monitoring path itself
Verify that a real tool call creates a record, that alerts reach the right owner, and that identity context and policy versions are present. OWASP AISVS flags weak SIEM correlation, drift checks performed only infrequently, and missing AI forensics as monitoring pitfalls. A dashboard alone is not evidence that the underlying events are being captured and acted on.
4. Make emergency shutdown independent of the agent
A person should be able to stop unsafe activity without asking the agent to cooperate or waiting for a developer. OWASP AISVS calls for “reliable, exercised shutdown and graceful-degradation paths under human control.”
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Define who can stop what
- Name the person or role authorized to stop the agent, and document how that person can act without developer intervention.
- Provide an out-of-band shutdown control isolated from the agent runtime. Do not make the agent’s own tool call or agreement the only way to stop it.
- Specify the control’s scope: blocking new tool calls, revoking credentials, interrupting active inference or jobs, halting downstream workers, and isolating connected services where necessary.
Plan for work already in progress
- Preserve traces and other relevant evidence when stopping the system.
- Prevent partial writes where possible; clearly mark incomplete work and avoid replaying it automatically on restart.
- Document recovery choices, including rollback to a stable version, disabling affected functionality, safe mode, and a human fallback for critical processes.
- Set continuity plans and safe fallback systems for operations that cannot simply stop. AWS Prescriptive Guidance recommends immediate shutdown capability and response procedures that can roll back, disable functionality, or move to safe mode when threats are detected.
Exercise shutdown and recovery
Rehearse the stop and recovery path on a schedule and after material architectural changes. Record the exercise date, result, owner, gaps, and remediation. A shutdown procedure that exists only in documentation or has never been tested is not an operational control.
5. Test failure and abuse cases before launch
Test the actual runtime—not just the prompt or a diagram—and verify that it denies, records, alerts, pauses, or stops as intended. OWASP recommends structured security testing before production and after material changes.
Include cases beyond the happy path
- Direct and indirect prompt override, including malicious instructions in retrieved content or memory.
- Unauthorized tool calls, privilege escalation, and attempts to cross user or tenant boundaries.
- Data exfiltration, recursive tool use, retry loops, and abnormal action volume.
- High-impact actions without valid approval, stale approval, changed parameters after approval, and approval-service or audit-path failure.
- Multi-agent delegation that attempts to expand authority beyond the originating task.
Keep a reproducible test record
For each test, record the agent, model, tool and policy configuration, case, expected outcome, observed outcome, and residual risk. Rerun relevant cases after changes to prompts, tools, tool policies, retrieval, memory, credentials, model or provider, or orchestrator. A configuration change can alter the effective authority or behavior even when the task description stays the same.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Assign responsibility for the actual deployment
Do not assume that a hosted agent service owns every security decision. Responsibilities differ among cloud service models and self-managed deployments, so identify who configures and operates each control: the customer, cloud provider, agent vendor, and downstream tool owner. Microsoft’s shared-responsibility guidance distinguishes IaaS, PaaS, and SaaS arrangements for agent scope, tool permissions, identity, approvals, orchestration limits, sandboxing, and monitoring. It also says customers always retain accountability for their data, agent identity and credential scope, authorization of actions, and human oversight.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWrite down the owner for permission changes, policy decisions, approval routing, monitoring and alert response, shutdown, credential revocation, and recovery. Confirm that each owner can perform the assigned task using the deployed platform—not merely that the task appears in a responsibility document.
Best Value
7. Use frameworks as guidance, not as a substitute for controls
NIST’s AI Risk Management Framework (AI RMF) 1.0 was released on January 26, 2023, and its Generative AI Profile, NIST-AI-600-1, was released on July 26, 2024. NIST describes the AI RMF as voluntary guidance and reports that AI RMF 1.0 is being revised. These frameworks can help organize risk management, but they are not a binding, platform-specific agent-security checklist and do not replace testing the permissions, monitoring, approval, and shutdown controls in the actual deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
