Executive Summary
Agent security focuses on the authority to observe, decide, and act—not only on the quality of model output.
Agency creates a different risk
An agent can plan across steps, retrieve external content, maintain state, and invoke tools. A single untrusted instruction can therefore propagate through a workflow. Risks include goal manipulation, indirect prompt injection, confused-deputy behavior, credential misuse, unauthorized delegation, excessive spending, persistent poisoned memory, and actions that are individually valid but harmful in sequence.
Giving an agent a human user's broad credential hides accountability and makes containment difficult. The system needs explicit boundaries for who requested an action, which agent instance is acting, what purpose was approved, which resources are allowed, and when approval expires.
Authority-centered architecture
Requester → task/authority grant → agent → policy + tool gateway → bounded tools; memory/provenance and action ledger surround the loop
A reference design gives each agent session a short-lived workload identity and a task-specific capability set. A policy enforcement point mediates every tool request, validates typed parameters, and considers requester, purpose, resource, sequence, cost, and risk. High-impact or irreversible operations pause for independent approval. Memory is partitioned by tenant and task, provenance accompanies retrieved content, and a durable ledger links plans, tool calls, responses, approvals, and changes.
Scoped capabilities
An agreed assessment can inventory agents and tools, map delegated authority, threat-model workflows, review identity and memory boundaries, design policy rules, and build adversarial test scenarios. It may deliver a privilege matrix, action taxonomy, approval design, kill and rollback requirements, evaluation plan, and prioritized backlog. Security review does not establish that an agent will always interpret a goal correctly.
- 01Agent, tool, credential, and data-flow inventory
- 02Task-scoped identity and authorization design
- 03Sequence abuse, memory poisoning, and rollback tests
Deployment and use cases
Deployment can begin in a sandbox with synthetic resources, move to read-only production access, and add narrowly reversible actions after evidence-based review. Private, cloud, and hybrid options are subject to assessment of model hosting, tool interfaces, identity systems, data residency, latency, and operational ownership. Stop conditions and manual alternatives should be defined before release.
Use cases include IT support, software delivery, customer operations, security investigation, procurement, and document workflows in finance, healthcare, government, technology, and manufacturing. Related technologies include workload identity, OAuth, policy engines, secrets vaults, API gateways, MCP, sandboxing, event logs, and workflow orchestration. No universal autonomy level, continuous supervision, performance metric, or guaranteed outcome is asserted.