AGENT SECURITY / REVIEWED OCTOBER 26, 2026
Limiting what an AI agent can do
An agent that can read, decide, and act needs limits enforced by the systems around it.
Start with the authority you are granting
Map the tools an agent can invoke, the records it can access, and the people or agents it can delegate to. Grant only the access needed for its current task. A summarization task should not automatically inherit the power to send messages, delete records, or transfer money.
Keep untrusted content out of the control plane
Documents, web pages, tool descriptions, and messages from other agents can carry instructions an attacker wants the system to follow. Treat them as data. Validate proposed tool actions and their arguments against authorization policy outside the model, rather than relying on a prompt to enforce the boundary.
Contain the consequences
Isolate code execution, restrict outbound destinations, use scoped and short-lived credentials, and require meaningful approval for consequential actions. Give the reviewer the actual action and target, not a vague request to continue. Apply budgets to tool calls and resource use so a loop cannot consume unlimited capacity.
Test the whole chain
Evaluate multi-step workflows, delegated actions, poisoned inputs, and recovery after a denied action. Record enough context to explain what happened without unnecessarily retaining sensitive content. Controlled red and blue team simulations, including our ChessPiece exploration, can surface assumptions; they are not proof that a production system is secure.
Sources and further reading
Every system has its own constraints. Discuss yours with us.