AI Agent Security
Decide These Before You Deploy
Agents decide and invoke tools on their own — closing tickets, changing settings, sending mail. The controls have to be designed before deployment, not after.
Four Questions to Answer First
These come before any tool choice.
Which systems does this agent reach, and under whose credentials?
Issuance is the only real control point. Split read from write per tool, and never bundle it into one broad token.
Which actions run without a human saying yes?
Divide by reversibility: log reads, policy-check writes, route the unrecoverable to approval.
Is there a record of what was called and what changed?
Conversation logs are not enough. Records must be per tool call and tamper-resistant to answer a regulator.
Who responds when this agent causes an incident?
Name the owner among the deploying team, the system owner, and security. Unassigned controls do not get operated.
Four Stages
Order matters. A policy written without visibility never gets enforced.
Find what is already connected
In most organizations engineering already uses code assistants and MCP integrations, and security has no list. The inventory comes before the policy.
Tier actions by risk
Sort into read, write, and irreversible. Blanket blocking produces workarounds; tiering is what holds.
Separate content from instruction
Text inside documents, tickets, and tool responses must never change policy. This is the core of indirect injection defense.
Attach records and ownership
Log per tool call, and name who reads those logs. A log nobody reads is not an asset.