Secure a multi-agent AI system by treating the entire workflow—not the model prompt—as the security boundary. Give each agent a distinct identity and narrowly scoped authority, isolate it from untrusted content and other sessions, and make an independent execution layer verify every consequential action. Use this checklist to map where instructions, data, credentials, and authority can travel, then test those paths before deployment and after meaningful changes.
1. Map the system and its trust boundaries
Start with an inventory of the components that can receive instructions, access information, or cause effects. A failure in one agent can cascade through tools, shared memory, external services, or downstream agents, so assess the complete workflow rather than reviewing each model in isolation.
As an Amazon Associate I earn from qualifying purchases.
- For every agent, record its role, owner, model or provider, tools, data sources, memory stores, and downstream agents.
- Draw the trust boundaries between people and agents, agents and tools, agents and one another, and trusted instructions and untrusted content.
- For every tool, document its capabilities, accessible resources, read and write operations, statefulness, reversibility, and how you can observe or verify its effects.
- Trace plausible abuse paths: goal or prompt hijacking, tool misuse, privilege abuse, exposed credentials, memory poisoning, compromised integrations, unexpected code execution, data exfiltration, cascading failures, and unbounded loops or costs.
NIST’s tool-use taxonomy offers useful assessment dimensions—including functionality, access patterns, risk, reliability, modality, and monitoring—but it is not a universal risk score. The risk of a tool depends on its implementation and deployment conditions. NIST and the Center for AI Standards and Innovation hosted an Artificial Intelligence Safety Institute Consortium workshop with approximately 140 experts in January 2025; that attendance figure describes the workshop, not a survey result or a measure of consensus.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →2. Set tool permissions outside the model
A model’s instructions and confidence are not an authorization system. Enforce permissions in an execution component, gateway, or policy service that checks the actual proposed operation before a tool runs.
#1 Best Overall
- Start from deny and explicitly allow only the tools and operations required for a task.
- Scope authority by agent, task, resource, operation, and environment. Keep read-only identities distinct from identities that can write.
- Check authorization against the exact target and parameters at execution time. Do not rely on a prompt telling the agent what it may do.
- Keep the decision to propose an action separate from the service that executes it: the model may recommend, but the execution layer independently verifies authority and approval.
- Do not treat an agent identity, a valid signature, or a generic approval indicator as permission for every request. The receiving service must still authorize the caller and the specific operation.
Review tool descriptions, integrations, dependencies, plugins, and third-party data sources as potential attack surfaces. Where applicable, pin and review integrations. OWASP’s MCP Top 10 project identifies tool poisoning and software supply-chain attacks among its risk areas; the project describes its current work as a beta and living document, not a settled standard.
3. Give each agent its own identity and protect credentials
Use a dedicated service or bot identity for each agent so actions can be attributed and access can be revoked independently. Keep administrative identities separate from agent identities, and avoid standing administrative roles for agents.
- Issue short-lived credentials scoped to the current task and the minimum required resources.
- Keep long-lived production secrets out of prompts, configuration files, and agent environments.
- Redact credentials and sensitive personal or confidential data from logs, traces, memory, and tool outputs.
- Record enough structured metadata to investigate high-risk actions without turning observability systems into another store of secrets.
The OWASP DevSecOps Guideline captures the central combination of risks: “An agent combines three things that are dangerous together: access to private data, exposure to untrusted content, and the ability to act or communicate externally.”
4. Isolate execution, sessions, and untrusted content
Run agents in a sandbox or otherwise constrained environment. Limit filesystem access and network egress to what the task needs, and separate agents and sessions at the memory and context layers so one user’s workflow cannot silently influence another’s.
- Treat retrieved documents, email, websites, API responses, tool outputs, and conversation history as untrusted input—even when they arrive through a tool your system normally uses.
- Keep untrusted content distinct from trusted instructions. Delimiting and labeling content can help, but labels alone do not enforce the boundary.
- Validate proposed actions and structured outputs against schemas and policy before execution.
- For risky documents, consider a quarantined parser with no tool access, followed by independent validation of any proposed action. This is a defense pattern, not a complete guarantee.
- Prevent low-trust content from becoming trusted instructions or persistent cross-user memory without an explicit, controlled process.
Prompt-injection defenses should be layered. Filtering or screening can help identify suspicious input, but it does not replace isolation, authorization checks, or validation of the action an agent proposes.
5. Match review and approval to the action’s impact
Classify tool operations by their impact, reversibility, statefulness, exposure, and observability. A read-only lookup is not equivalent to a bulk deletion or a payment, even if both are initiated through the same agent.
Rank #4
| Action profile | Examples | Control to apply |
|---|---|---|
| Low impact, read-only, and observable | Retrieving permitted information without changing state | Allow only explicitly approved operations, with scoped access and logging appropriate to the data. |
| Constrained write with limited, reversible effects | Changing a narrow, non-critical setting | Validate the target and parameters against policy; use bounded permissions and an auditable execution path. |
| High impact, externally visible, or difficult to reverse | Payments, privilege changes, bulk deletion, production deployment, or external communications | Require human review or independent policy validation, and bind approval to the exact proposed action. |
For a consequential action, bind approval to the actor, tool, target resource, normalized parameters, timestamp, and expiry. Require fresh approval if the target or parameters change. Use short-lived authorization artifacts, replay protection, and idempotency where possible. Fail closed if policy, approval, risk classification, or audit checks fail.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →6. Constrain agent-to-agent communication
Define which agents may communicate, which message types they may send, and what authority a receiver may exercise in response. A message from a trusted sender is not automatically an authorized instruction.
Best Value
- Authenticate the sender and check its permission at the receiving service.
- Validate message structure and parameters; prevent chains from escalating privileges or carrying untrusted instructions across trust boundaries.
- If messages are signed, use a maintained protocol implementation and include the sender, intended recipient, message type, payload, creation and expiry times, and a unique message identifier.
- Reject expired or replayed messages.
- Bound chain depth, retries, tokens, and costs, and add circuit breakers so a runaway chain or cascading failure can be contained.
7. Test, monitor, and update the controls
Run structured security tests before production and after material changes to prompts, tools, memory, retrieval, policies, or model providers. Keep the tests repeatable so changes can be assessed against the same abuse cases.
- Test prompt override and injection, unauthorized tool use, privilege escalation, memory poisoning, data exfiltration, recursive tool abuse, approval bypass, and cross-agent trust-boundary failures.
- Monitor agent actions and high-risk decisions, including denials, approvals, timeouts, and circuit-breaker outcomes.
- Retain versioned evidence of the tested model or provider, tool policy, retrieval configuration, and abuse cases so an incident or change can be investigated.
- Include threat modeling, continuous monitoring, and regular security assessments in the operating process. CISA’s May 1, 2026 announcement summarizing joint guidance recommends these practices; the announcement is a summary, not the full guidance text.
- Periodically review evolving agent and MCP security guidance rather than treating a beta project’s risk list as static.
Use deployment-specific judgment
No checklist guarantees security. The controls you need depend on tool capabilities, the deployment environment, data sensitivity, and the consequences of an action. In particular, compare tools and architecture choices by what they can change, what persists if they fail, whether effects can be reversed, whether their actual behavior is observable, and whether memory or context is isolated. The final permission check belongs in code outside the model.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
