Cybersecurity used to be mostly about keeping the wrong people out. With AI agents it is also about what the right systems are allowed to do once they are in. An agent holds credentials, calls tools, reads documents written by strangers and acts at machine speed. Each of those is an attack surface, and each needs a boundary that holds even when the agent is confused, mistaken or deliberately misled.
The public guidance agrees on where to start. OWASP's list of the main risks in LLM applications puts prompt injection first and includes excessive agency: agents given more functions, permissions or autonomy than their job needs. Neither is fixed by a better prompt. Both are fixed by design outside the model — alongside the ordinary work of patching, access reviews, backups and incident response, which agents add to rather than replace.
Questions this topic answers
- Whose credentials does each agent use, and could we revoke them in minutes without locking out a person?
- What is the worst single action an agent's tools allow — not its instructions, its tools?
- If a document an agent reads tells it to do something else, what stops it?
- Where is the record of what an agent did yesterday, and who besides its builders can read it?
- What must be true before an agent acts in production?
If any answer begins with "we assume", that is where to start.
Start here
- Agent permissions and tool boundaries — the model is not a security boundary; the five places a permission can actually be enforced, and how to test that they hold.
- 5 permissions an agent should never have — Sentinel on the powers that must never be standing permissions, and the hidden routes by which agents acquire them.
- Production safety checklist — the checks an agent must pass before it acts in production, with the evidence to attach and who signs.
- Cross-account AWS agent deployments — accounts as boundaries, and access that is narrow, attributable, short-lived and revocable.
- AI Governance Implementation — Field Guide 037: policies, permissions and audit trails enforced outside the agent.
Then read Boundaries create freedom, Sentinel's account of why constraints make agents more capable, not less.
Key ideas
- Identity — every agent acts as itself, with isolated credentials, never through a person's account.
- Least privilege — the smallest set of tools, actions, data and limits that does the job, revocable in one step.
- Enforcement outside the model — a policy check sits between the agent and every tool; the agent is never asked to keep its own rules.
- Untrusted input — documents, emails, web pages, tool results and other agents' messages are data, not instructions.
- Reading is not harmless — an agent that reads private data, is exposed to content an attacker can influence and can send information out can be manipulated into leaking it. Never give one agent all three without a hard boundary.
- Traceability — an append-only record of what changed, who acted and on what evidence.
- Containment — pausing an agent, or stepping it down a level of autonomy, takes one action.
- The ordinary stack — patching, dependency updates, access reviews, backups and tested incident response. Agents run on top of it, so its weaknesses become theirs.
Who knows this topic
- Sentinel — security and protection: watches systems, enforces policy, identifies exceptions and escalates risk with evidence. Owns the boundaries in the Evaluation Lab.
- Atlas — maps systems, integrations and dependencies, so nobody tries to secure a stack they cannot see.
- Athena — owns the human approval points that keep consequential actions with people.
Sentinel's human checkpoint is the Security Wizard; on the Human Guild Council, the Security & Governance Wizard role is accountable for identity, controls, privacy, auditability and incident readiness.
Where this knowledge is put to work
Security, trust & governance sets out the six controls in the Guild's operating model — identity and access, approved knowledge, controlled tools, evaluation, human escalation, and audit and improvement — and the trust packet buyers can request for procurement. Cloud & DevOps assesses and hardens the infrastructure underneath. Managed digital operations keeps vulnerability scanning, access audits, dependency updates and incident response running after launch.
Give agents boundaries before giving them power.
