An AI agent should be treated like a privileged software identity. The more systems it can access and the more actions it can perform, the more important it becomes to control permissions, validate instructions and maintain an audit trail.
Give every agent a defined identity
Avoid shared credentials. Use a dedicated service identity or application identity wherever the platform supports it. This makes access easier to control, review and revoke.
Start with the least privilege possible
Only grant access required for the specific workflow. If an agent needs to summarize tickets, it may not need permission to delete them. If it needs to draft an email, it may not need permission to send it automatically.
Separate read actions from write actions
Reading data and changing data carry different levels of risk. For higher-risk workflows, require a human approval step before the agent sends, deletes, modifies, transfers or approves anything important.
Protect secrets and API credentials
Store API keys and tokens in a secrets manager or protected environment variables. Do not place credentials in prompts, source code, documents or chat history. Rotate credentials when access changes or a workflow is retired.
Validate external content
Agents may consume websites, documents, email or third-party data. That content can contain misleading instructions or prompt injection attempts. Do not allow untrusted content to override security policy or system-level restrictions.
Monitor actions, not just prompts
Logging should capture which agent acted, which user initiated the workflow, what resources were accessed and what changes were made. Security teams should be able to investigate unusual behaviour just as they would investigate activity from a user account or application.
Set boundaries for autonomous actions
Define what the agent may do without approval, what requires approval and what it must never do. High-impact actions involving financial transactions, privileged access, security controls, legal commitments or sensitive data should have stronger safeguards.
Include AI agents in incident response
Organizations should know how to disable an agent quickly, revoke its credentials, preserve logs and review affected systems. AI workflows should be included in security inventories and incident response planning.
Minimum control set for AI agents
Dedicated identity. MFA where applicable. Least privilege. Short-lived credentials where supported. Read-only defaults. Human approval for sensitive actions. Central logging. Alerting on unusual activity. Clear ownership. Documented shutdown procedure.
Security architecture before automation
The safest AI automation starts with clear permissions and business rules before the workflow is built. For a broader review of your environment, see our Cybersecurity Gap Assessment, Managed Detection and Response and Cybersecurity Knowledge Center.