Least-privilege access for the agent
The agent holds only the tools, data and rights its task needs. |
Hidden instructions hijack the agent · Agent takes destructive or unapproved actions · Credential and privilege abuse · Data leaked or sent out · Supply-chain compromise |
did not hold in 1 |
Separate identity for each agent
Each agent acts under its own account, not a person's or a shared one. |
Credential and privilege abuse · Agents coordinating against their limits |
not seen in an incident yet |
Short-lived, scoped credentials
Keys and tokens expire quickly and cover one task. |
Credential and privilege abuse · AI system attacked or breached |
not seen in an incident yet |
Secrets kept out of the model's context
Credentials are used by code around the model, never shown to it. |
Credential and privilege abuse |
not seen in an incident yet |
Production kept apart from test
The agent cannot reach live systems from a test or development task. |
Agent takes destructive or unapproved actions |
did not hold in 1 |
Rate and spend limits
Caps on calls, actions and cost per task. |
no risk linked |
not seen in an incident yet |
Human approval for high-impact actions
A person confirms before the agent deletes, sends, pays or deploys. |
Hidden instructions hijack the agent · Agent takes destructive or unapproved actions · Data leaked or sent out · Deception, concealment or sabotage · Made-up output relied on · Privacy harm to a person · Physical harm |
did not hold in 9 |
Change review and separation of duties
Changes to live systems need a second reviewer. |
Agent takes destructive or unapproved actions |
not seen in an incident yet |
People told they are dealing with AI
Users and third parties know when an AI is acting or speaking. |
Made-up output relied on · Privacy harm to a person · Manipulation and misinformation |
not seen in an incident yet |
Output filtering and redaction
Output is checked for sensitive or forbidden content before it leaves. |
Data leaked or sent out · Harmful content and jailbreaks · Made-up output relied on · Privacy harm to a person · Bias and discrimination · Copyright and IP |
did not hold in 1 |
Segmentation of agent components
Tools, data and agents sit behind separate boundaries. |
Hidden instructions hijack the agent · Agent escapes its sandbox · AI system attacked or breached |
not seen in an incident yet |
Activity logs
Every agent action and tool call is recorded. |
Agent takes destructive or unapproved actions · Credential and privilege abuse · Data leaked or sent out · Deception, concealment or sabotage |
not seen in an incident yet |
Live behaviour monitoring
Agent activity is watched as it happens, with alerts. |
Agent escapes its sandbox · AI system attacked or breached · Deception, concealment or sabotage · Gaming the task (reward hacking) · Agents coordinating against their limits · Physical harm |
did not hold in 4 |
Alerts on unusual tool use
Spikes or odd patterns in tool calls raise an alert. |
Hidden instructions hijack the agent · Credential and privilege abuse |
not seen in an incident yet |
AI incident response plan
A tested plan for containing and fixing an AI incident. |
AI system attacked or breached |
not seen in an incident yet |
Serious-incident reporting
Incidents are reported to authorities and affected parties. |
no risk linked |
not seen in an incident yet |
Signed and verified components
Packages, plug-ins and models are signature-checked before use. |
Supply-chain compromise |
not seen in an incident yet |
AI bill of materials
A list of every model, dataset and component in use. |
Supply-chain compromise |
not seen in an incident yet |
Vetting of plug-ins, skills and dependencies
Third-party components are reviewed before the agent can use them. |
Supply-chain compromise |
not seen in an incident yet |
Vulnerability scanning of AI components
Agent platforms and their services are scanned and patched. |
Agent escapes its sandbox · Supply-chain compromise · AI system attacked or breached |
not seen in an incident yet |
Model provenance checks
Open-weight models are checked against a trusted source before use. |
Supply-chain compromise |
not seen in an incident yet |
Data minimisation
Only data the task needs is put in the agent's context. |
Data leaked or sent out · Privacy harm to a person |
not seen in an incident yet |
Sensitive-data checks on outbound data
Personal data and secrets are caught before they leave. |
Credential and privilege abuse · Data leaked or sent out · Privacy harm to a person |
not seen in an incident yet |
Encryption of stored data
Data the agent can reach is encrypted at rest. |
AI system attacked or breached |
not seen in an incident yet |
Adversarial testing before deployment
The deployed agent is attacked in testing before it goes live. |
Agent takes destructive or unapproved actions · Agent escapes its sandbox · AI system attacked or breached · Physical harm |
not seen in an incident yet |
Risk assessment per deployment
Each use of the agent is assessed for risk before launch. |
Privacy harm to a person · Bias and discrimination |
not seen in an incident yet |
User policy and training
People using the agent know its limits and the rules. |
no risk linked |
not seen in an incident yet |
Grounding and fact checks
Factual output is checked against sources before use. |
Made-up output relied on |
not seen in an incident yet |
Bias testing
Outcomes are tested across groups. |
Bias and discrimination |
not seen in an incident yet |
Physical safety interlocks
Hardware limits stop unsafe movement whatever the model says. |
Physical harm |
not seen in an incident yet |