Identity, authorisation, sandboxing and security controls for agents that can observe data and take action.
Agent credentials should be shorter-lived than the assumptions that justify them. Bind them to a workload, audience, task and action, then prove renewal and revocation work.
Investigators need more than chat transcripts. Preserve identity, instructions, retrieved context, model and tool versions, policy decisions, credentials, network events and actual state changes.
“Internet access” is too broad a permission for an agent. Define destinations, protocols, data-release rules and failure behaviour, then test bypasses against the deployed network path.
Least privilege for agents is not a smaller role assigned once. It is authority narrowed by identity, task, resource, action, time and consequence at every tool call.
Review an MCP server as a privileged protocol adapter: verify tool semantics, OAuth boundaries, token audience, downstream delegation, input handling, isolation, logging and consent.
A useful agent threat model follows data, instructions, identity, tools and state across trust boundaries. This method turns the map into test cases and control decisions.
An agent becomes especially risky when it can read secrets, ingest attacker-controlled material and communicate or act outside the boundary. Design the workflow to break that combination.
A sandbox limits what compromised execution can reach. Authorisation decides what an authenticated actor may do. Secure agents need both, tested independently and together.
Stopping one process may leave tools, queued actions, delegated agents and credentials active. Define the safe state, control every action path and rehearse the stop under load.
Prompt injection becomes consequential when untrusted content can steer a model towards privileged tools. Reduce the blast radius by redesigning the workflow around trust and authority.
KEEP EXPLORING
Read the method, assumptions and questions to ask.