Practical guidance on securing AI agents, tools, and the systems they act on, written by the team building the trust layer for AI agents.
Workload identity gives an AI agent a verifiable, non-human identity tied to its runtime environment rather than a long-lived secret it carries around.
User identity and agent identity answer different questions, who a request is for versus what software actually made the call, and both need to be tracked together.
An AI agent should generally have its own identity, distinct from the user it acts for, so its actions can be authorized, rate-limited, and audited independently.
IAM for AI agents extends identity, authentication, and authorization practices to cover non-human actors that call tools and take actions on a system's behalf.
A structured checklist covering authentication, authorization, validation, monitoring, and supply chain review for teams securing MCP servers and AI tool integrations before production.
Securing file and cloud storage tools used by AI agents means scoping access to specific paths and buckets, validating file paths strictly, and treating file content returned to the model as untrusted input.
Securing email and messaging tools used by AI agents means constraining recipients, requiring approval for external sends, and treating every outbound message as a potential data exfiltration or impersonation path.
Securing database tools used by AI agents means avoiding raw query access, scoping permissions to specific rows and columns, and validating that every query respects the requesting user's actual data boundaries.
Preventing parameter manipulation in AI tool calls means validating every value the model generates against strict types, ranges, and business rules, since a manipulated parameter can turn a correctly chosen tool into a harmful action.
Tool allow lists restrict an agent to a known set of approved tools by default, while deny lists block specific tools and allow everything else, and the two approaches carry very different risk profiles for AI systems.
Securing AI-generated API calls means validating parameters independently of the model's reasoning, enforcing authorization at the call boundary, and never letting a well-worded request substitute for a real permission check.
Giving an LLM API access introduces risk because the model decides which calls to make based on interpreted language, which means manipulated input can translate directly into unauthorized or unintended API calls.
