AI Agent Security Checklist

Why agents need their own security thinking

An AI agent is software that takes a goal, plans steps, and executes them with tools. That makes it different from a chatbot in one crucial way: a chatbot can only say the wrong thing, while an agent can do the wrong thing — send the email, delete the record, move the money. Agents amplify both productivity and mistakes, which is why they deserve security controls designed around what they can do, not just what they can say. If you're new to agents, our SI agent explainer covers the concept.

The 12-point security checklist

1. Apply least-privilege access. Give the agent the minimum permissions its task needs. Read-only where possible; write access only where the task requires it.
2. Require approval for irreversible actions. Anything that messages customers, spends money, deletes data, or changes production systems pauses for a human. This is the single highest-value control on this list.
3. Isolate the agent's credentials. Use dedicated API keys and service accounts for each agent — never a personal admin account. Revoke and rotate them like any other secret.
4. Treat all external content as untrusted. Emails, web pages, files, and ticket bodies can carry prompt injection: hidden instructions that steer the agent off-task. Don't let an agent act on untrusted content without a human reviewing the plan.
5. Segment what the agent can see. Don't connect the agent to every system at once. Scope data access to the task, and separate agents by function so a compromise of one doesn't reach everything.
6. Log every action. The agent should produce an audit trail: what it read, what it decided, what it changed. Review the logs weekly at first, monthly once stable.
7. Set spend and usage limits. Cap API spend, execution counts, and credits so a runaway loop or misconfigured trigger can't generate a surprise bill or a flood of actions.
8. Redact sensitive data from prompts. Don't paste secrets, full customer databases, or credentials into agent instructions or test chats. Assume anything in the prompt could be logged.
9. Review third-party integrations. Every connector is a new trust relationship. Check what permissions each integration requests, and remove ones you no longer use.
10. Test with adversarial inputs. Before going live, try to break the agent: contradictory instructions, fake "urgent" emails, requests beyond its scope. Fix what you find in the instructions and guardrails.
11. Have a kill switch. Know exactly how to stop the agent instantly — disable the schedule, revoke the key, pause the workflow — and make sure more than one person knows how.
12. Plan for the vendor's security, too. If you use a commercial platform, review its certifications (SOC 2, GDPR, HIPAA where relevant), data retention policy, and subprocessors. See the vendor questions below.

Security questions to ask any vendor

• Where is my data stored, how long is it retained, and is it used to train models?
• What certifications do you hold (SOC 2, ISO 27001), and can I see the reports?
• How are customer credentials stored, and who at your company can access my data?
• Do you support SSO, role-based access, and audit logs on my plan — not just enterprise?
• What happens to my data if I cancel?
• Do you offer a HIPAA-compliant tier with a signed BAA, if my industry needs it?

Our best AI agents roundup notes which platforms publish enterprise-grade security features, and our open-source vs commercial comparison covers the control trade-offs of self-hosting.

Start strict, loosen deliberately

The pattern that works: deploy with maximum controls — approvals on, narrow access, tight budgets — and relax them one at a time as the agent proves itself. An agent that earns trust over weeks is an asset; one trusted on day one is a liability. Security for agents isn't a one-time setup; it's a habit of reviewing logs, permissions, and instructions as the agent's job evolves. Read how we rank agents to see how security factors into our evaluations.