Agents change the threat model
A chatbot that drafts text and an agent that can update a CRM record, query production data or trigger an administrative workflow do not carry the same risk. Tool use introduces authorization, transaction integrity, excessive agency and abuse-path concerns.
Treat every agent as an identity
Agents should have explicit identities, scoped permissions and traceable actions. Avoid shared high-privilege service accounts. Use least privilege and short-lived credentials where possible, and separate read permissions from write or administrative actions.
Constrain tools and actions
Use allow-lists for tools and parameters. Apply deterministic policy checks before consequential actions execute. Classify actions by risk and reversibility, and require human approval for sensitive or irreversible steps.
Defend against indirect prompt injection
Untrusted content inside documents, web pages, tickets or emails can attempt to manipulate an agent. Separate retrieved content from system instructions, validate tool arguments, restrict privileged actions and test adversarial content as part of security evaluation.
Observe what the agent did
Capture model and prompt versions, retrieved context, tool calls, policy decisions, approvals and final outcomes. This telemetry is necessary for incident investigation and for proving that agent controls are operating effectively.