AI agent security: define access and responsibilities

Treat incoming messages and documents as untrusted data: instructions in an attachment must not grant permissions. Keep secrets out of model instructions. Record the action, its status and useful approval evidence with appropriate access and retention, without unnecessarily copying the entire case.

A technical control blocks a forbidden operation; deciding who may authorise it belongs to your organisation. Testing one does not prove that the other has been decided.

Map system boundaries

List users, sources, tools and destination systems. For each exchange, identify the credentials used, information transmitted and available operations. This shows where a model decision can become a real action.

Distinguish information being read from authorised instructions. A document or incoming message may try to redirect the system’s behaviour. OWASP describes prompt injection as a relevant risk at this boundary.

Match controls to actions

Place human review before the action concerned and show enough detail to support a meaningful decision.

Test boundaries directly

Include out-of-scope requests, less-privileged users, contradictory sources and suspicious instructions in documents. Verify both what the system displays and what it actually executes.

A well-worded refusal is insufficient if a tool was still called. Application checks and logs should establish the real behaviour rather than only the generated explanation.

Assign responsibilities

Name business, technical and data owners. Decide who approves a new tool, expanded permissions or a model change. A deployed capability continues to change and needs ongoing ownership.

A risk management approach can help organise these decisions. The NIST AI RMF is a general reference; using it does not establish certification or compliance for a product.

Prepare incident handling

Define how to stop an action, revoke access and identify affected operations. Retain information needed for investigation within an appropriate scope and duration. Logs should not become an uncontrolled copy of business documents.

Prepare user communication and a manual fallback. After a fix, rerun the cases that exposed the problem before broadening usage again.

Common questions

Can we grant broad access to simplify a prototype? A prototype still needs explicit boundaries. Excessive permissions increase the consequences of mistakes and weaken the relevance of its findings.

Must every action be approved manually? Controls should match the consequences and be defined by action category, then verified in operation.

Does security work end at launch? No. New tools, users and data change the scope to examine.

Capture these decisions in agent requirements and production planning. Explore Binov’s technical leadership support.