Practical guidance on securing AI agents, tools, and the systems they act on, written by the team building the trust layer for AI agents.
A practical, grouped checklist covering identity, scoping, approvals, credentials, and emergency controls for reviewing whether an AI agent's access is actually safe.
A kill switch for an AI agent needs to stop it immediately across every path it can act through, and emergency access needs its own tightly controlled process.
Auditing who authorized an AI action means reconstructing the user, agent, policy decision, and approval that led to it, from a record that can't be edited after the fact.
Credentials leak out of agentic systems through prompts, logs, memory, and tool outputs more often than through a classic breach, because agents handle secrets as text.
Privilege escalation by an AI agent happens when it accumulates access beyond its intended scope, often through chained tool calls rather than a single obvious grant.
Separation of duties splits a sensitive workflow across multiple agents or an agent and a human, so no single actor can both initiate and approve the same action.
Revoking an AI agent's access needs to take effect immediately across every credential and delegated token it holds, not on the next scheduled refresh cycle.
Time-bound permissions grant an AI agent access only for the duration a task genuinely needs, so standing access doesn't outlive the reason it was ever granted.
Transaction limits cap how much value or how many actions an AI agent can move before a hard stop kicks in, enforced outside the model where a prompt can't argue past it.
An AI agent should ask for permission when an action is irreversible, exceeds a defined threshold, falls outside its normal pattern, or affects someone besides the requester.
Approval fatigue sets in when agents generate more approval requests than humans can meaningfully review, turning a real control into a reflexive rubber stamp.
A good approval workflow for AI agents blocks the specific action until a qualified person reviews real context, routes correctly, and fails closed if nobody responds.
