Assess an AI agent as a connected system—not just a model. Map its identity, credentials, tools, permissions, data flows, operators, and downstream services; then test whether it can be induced or allowed to exceed its intended authority. A repeatable assessment should show what the agent can do, what information it can reach, which principal is accountable for each action, and what happens when a control fails.
Why an AI agent’s risk boundary extends beyond its model
An agent combines model output with software functions that can retrieve information, call APIs, execute code, send messages, or take other actions. Its effective authority depends on the whole deployment: model and framework, orchestrator, tools and connectors, credentials, memory and data stores, human operators, and downstream systems. A model-only review can miss the permissions and exposure created by these connections.
As an Amazon Associate I earn from qualifying purchases.
Start by documenting the system as it runs, including what each component can read, write, execute, send, initiate, delegate, or change. Include external agents and plugins, cached credentials, and any path by which an agent can affect its own configuration. NIST’s January 2026 CAISI request for information on securing AI agent systems discusses risks including indirect prompt injection, adversarial data, insecure models, data poisoning, and harmful actions that occur without adversarial input.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →How to run a repeatable AI agent risk assessment
1. Define the system and authority boundary
Inventory the agent instance and the services it relies on. For every connection, record the resource, action, owner, and trust boundary. Distinguish actions the agent can perform directly from actions it can request through an operator or another agent.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Components: model, framework, orchestrator, tools, APIs, plugins, external agents, memory, data stores, and downstream services.
- Actors: the human or system that authorized the task, operators who can change the setup, and service owners responsible for connected resources.
- Capabilities: read, write, execute, administer, message, initiate transactions, delegate, and modify configuration.
- Boundaries: organization and tenant boundaries, external services, untrusted content sources, and destinations to which data or actions can flow.
Use this inventory as the scope for the rest of the assessment. A connection that is present but believed to be “unused” still belongs in scope until its access is removed or its reach is verified.
2. Assess identity and credentials
For each agent instance and supporting workload, establish who or what it is, who authorized its task, and how its actions can be attributed. Record the principal, credential type, scope, owner, lifetime, storage location, rotation process, revocation method, and associated audit trail. “The agent has access” is not enough to establish accountable identity or explain how access can be withdrawn.
- Does the agent have a distinct identity, linked to the human or system that authorized its task?
- Are credentials attributable to the agent and task, or is the agent borrowing a person’s shared credentials?
- Are credentials narrowly scoped, protected in storage and transit, revocable, and rotated? Use short-lived credentials where feasible.
- Could secrets appear in source code, configuration, prompts, markdown files, logs, or data the agent can retrieve?
- Can an operator revoke this agent’s access without disrupting unrelated users or workloads?
NIST NCCoE’s August 27, 2026 article, “Back to the Future: Why Agentic AI Needs a Strong Identity Foundation,” argues that agents should be first-class entities with unique identifiers, credentials, and entitlements tied to the identity of the user or system operating them. It warns that shared human credentials weaken accountability, while static API keys and long-lived bearer tokens can be broadly usable and exposed. Anyone possessing a bearer token may present it; broad credentials may also be left in configuration files, markdown files, or logs.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Measure effective access and privilege
Build an access matrix that shows what each agent can do with each tool and resource. Separate read, write, execute, administrative, and delegation permissions. Include inherited roles, dynamically delegated scopes, cached credentials, and trust between agents. Compare these effective rights with the minimum authority required for the assigned task.
Do not assess only the permissions documented for the agent. Verify what its credentials, connected tools, delegated scopes, and runtime environment allow in practice. Test whether restrictions continue to hold when inputs are malicious, irrelevant, or ambiguous. For consequential operations, identify approval gates and whether an action can be reversed. NIST’s August 5, 2025 discussion of tool use in agent systems notes that implementations may limit write access or constrain broad tools such as code execution; these restrictions should be checked against the actual deployment.
4. Trace data exposure from retrieval to output
Follow sensitive information through the complete interaction: what the agent can retrieve or observe, what enters prompts or memory, what tools receive it, and where responses, logs, and actions go. Identify data classification, external services, retention, deletion paths, and any crossing of organizational or trust boundaries.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Test whether untrusted content—such as an email, file, or web page—can steer the agent to disclose data or send it to an unauthorized destination. NIST’s evaluation work describes hijacking through malicious instructions embedded in task-relevant data. The OWASP Agentic Security Initiative taxonomy includes goal hijacking and tool misuse that may result in data exfiltration. Treat content the agent reads as a possible source of instructions, not automatically as trusted direction.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems5. Test credible threat scenarios
Write tests around plausible paths in this particular deployment, not merely generic demonstrations. At minimum, cover the following where applicable:
- Indirect prompt injection in an email, document, web page, or other content the agent is asked to process.
- Overbroad or stolen credentials, including an attempt to use access outside the task’s intended scope.
- Unauthorized tool calls, such as a write, execution, or external send that the task does not require.
- Harmful actions without an attacker, including an agent taking an unintended action in response to an ordinary task.
- Use of a compromised or unverified tool, connector, plugin, or external agent.
- Unintended delegation or cross-agent impersonation.
For each test, record the preconditions, task, input, attempted tool or action, whether a control blocked or flagged it, possible data or system impact, and recovery. NIST CAISI’s January 17, 2025 work on strengthening AI agent hijacking evaluations says evaluations should adapt as defenses change, include task-specific attacks as well as aggregate outcomes, and consider multiple attempts. Record impact as well as success: successful attacks can differ substantially in consequence.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Rate and prioritize risk in deployment context
Describe likelihood and impact for each scenario in the actual deployment rather than assigning a universal score. Consider data sensitivity, privilege, action reversibility, affected people and systems, operational or financial consequences, and whether audit evidence would support attribution. Record uncertainty and what the tests did not cover. Prioritize scenarios with severe potential impact and plausible paths; assign a treatment owner, deadline, and residual-risk decision.
This approach reflects NIST CAISI’s call to anticipate and measure agent risks and its evaluation work’s warning that the impact of a successful attack varies. The available NIST materials do not establish a universal agent-risk score or a prevalence figure that can substitute for deployment-specific assessment.
Free tools Windows power users keep installed
One-click scans. No signup required.
7. Verify controls continuously
Put controls where they can constrain the actual path from identity to action and data. Use attributable identities, least privilege, scoped and revocable credentials, constrained tool interfaces, protected secrets, data minimization, monitoring, and audit logs. Require human approval for high-impact actions when appropriate to the risk, and repeat adversarial tests after meaningful changes.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Reassess when the model, tools, permissions, data sources, or operating context changes. No single control eliminates agent risk: identity and authorization, runtime restrictions, data controls, monitoring, and evaluation address different failure paths. These recommendations draw on NIST’s identity, tool-use, access-constraining, and evaluation materials.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to record so another team can reproduce the assessment
Keep one record per agent and scenario, with enough detail for an operator to reproduce a test and an owner to act on its result.
| Record | What to capture |
|---|---|
| Agent and authority | Agent instance, owner, authorizing user or system, connected components, and permitted actions. |
| Identity and credentials | Principal, credential type and scope, lifetime, storage, rotation, revocation, and audit linkage. |
| Access and data | Tool and resource permissions, delegated scopes, sensitive data reachable, destinations, retention, and trust-boundary crossings. |
| Test scenario | Preconditions, task, input, attempted action, control response, impact, and recovery steps. |
| Risk decision | Contextual likelihood and impact, uncertainty, test coverage, treatment owner, deadline, and residual risk. |
How to compare agent implementations without mistaking claims for controls
When evaluating a framework, vendor, or internal implementation, compare the evidence it provides for the same deployment needs. Relevant dimensions include distinct identity and user or system attribution; permission granularity and delegated-scope controls; credential scope, lifetime, storage, and revocation; data retrieval, isolation, retention, and egress controls; tool restrictions and human approval; audit completeness; and support for repeatable, task-specific red teaming.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Ask for demonstrations or configuration evidence that correspond to your threat scenarios, then verify behavior in your environment. The NIST materials identify these as relevant assessment areas; they do not validate or rank particular vendors.
What current guidance does—and does not—establish
Agent identity and security guidance is developing, so distinguish published frameworks from drafts and evolving taxonomies:
- NIST’s AI Risk Management Framework 1.0 is voluntary guidance for integrating trustworthiness considerations into design, development, use, and evaluation. NIST’s framework page says revision is underway; it is not a binding or agent-specific security standard.
- NIST NCCoE’s February 5, 2026 concept paper, “Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization,” was an initial public draft. Its comment period closed April 2, 2026. It raises identification, authorization, auditing, non-repudiation, and prompt-injection controls as areas of interest; it is not a final standard.
- NIST IR 8596 surfaced as an initial preliminary draft in December 2025. Its proposed focus on unique agent identities and credentials, cryptographic signing, and mutual authentication should not be treated as final guidance.
- The OWASP Agentic Security Initiative taxonomy surfaced in a NIST-hosted presentation as a release candidate. Its categories—including Agent Goal Hijack, Tool Misuse & Exploitation, Identity & Privilege Abuse, and Agentic Supply Chain Vulnerabilities—are useful for organizing scenarios, but the taxonomy is evolving rather than a settled standard.
NIST CAISI’s May 18, 2026 summary of responses to its request for information reports that commenters widely agreed agents present novel security threats and that existing cyber practices need adaptation. That is a qualitative summary of stakeholder responses, not a measurement of how often incidents occur or how much loss they cause. No named statistic in the cited material directly quantifies agent identity, access, or exposure prevalence or loss.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
