Free resource · AI Agent Security Checklist

The AI Agent Security Checklist

37 practices across 9 areas for teams deploying AI agents — from inventory and permissions to prompt injection, runtime policy, audit evidence and incident response.

Start the checklist Request a Security Assessment

How to use it: check each practice your organization has in place for a given agent or AI workflow. Your progress stays in this browser tab and is not sent anywhere. This checklist is practitioner guidance — not a certification, audit standard or compliance attestation. References are to the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework.

0 of 37 practices in place

01 · NIST AI RMF: Map

Inventory and ownership

You cannot secure agents you do not know exist. Shadow agents built on personal API keys are a common blind spot.

Maintain an inventory of every AI agent and AI-enabled workflowInclude purpose, business owner, technical owner, models and providers used, and the environment it runs in.
Record what each agent can reachList the tools, APIs, data stores and systems of record each agent can read from or act on.
Classify the data each agent may encounterNote regulated, confidential and customer data so controls can be matched to sensitivity.
Assign accountable owners and a review cadenceEvery agent should have a named owner responsible for its risk and a date for its next review.

02 · OWASP LLM: Excessive Agency

Identity, permissions and tool access

An agent’s blast radius is defined by its permissions. Over-broad access turns a single manipulated instruction into a serious incident.

Give each agent its own identityDo not run agents on shared service accounts or a human user’s credentials.
Apply least privilege per toolGrant only the operations the use case needs — read-only where possible, and scoped to specific resources.
Use short-lived, centrally managed credentialsKeep secrets out of prompts, system instructions, code and agent configuration files.
Allowlist the tools an agent may callDeny by default, and review any expansion of an agent’s toolset as a change.
Require human approval for high-impact actionsPayments, deletions, external communications and permission changes should not execute on model output alone.

03 · OWASP LLM: Prompt Injection

Prompt injection and untrusted content

Agents read emails, web pages, documents and tool outputs that attackers can influence. Any of these can carry instructions.

Treat all retrieved and third-party content as untrustedThis includes RAG results, web pages, email bodies, file contents and responses from other tools or agents.
Separate instructions from dataClearly delimit untrusted content and design prompts so that data is never treated as authoritative instruction.
Restrict actions after exposure to untrusted inputOnce an agent has read untrusted content, limit or require approval for sensitive follow-on actions.
Inspect inputs and outputs at runtimeScreen for injection patterns and anomalous instructions, and record what was detected.
Keep secrets out of system promptsAssume system prompts can be extracted; they must not contain credentials or sensitive logic.

04 · OWASP LLM: Sensitive Information Disclosure

Sensitive-data protection

Sensitive information can leave through prompts sent to providers, model outputs, logs and tool calls.

Detect and handle sensitive data in prompts and outputsApply redaction, masking or blocking according to policy before data reaches a model or leaves the system.
Enforce user permissions at retrieval timeRetrieval-augmented systems should only return content the requesting user is entitled to see.
Review provider data-handling termsConfirm retention, training-use and data-location terms for every model and AI service in use.
Minimize what is loggedLog enough for security and audit, with sensitive fields protected and retention limited.

05 · OWASP LLM: Improper Output Handling; Unbounded Consumption

Output handling and action safety

Model output that flows into interpreters, queries, browsers or other systems can become an injection vector of its own.

Validate and encode model output before useNever pass raw output into shells, SQL, templates or HTML without validation appropriate to the destination.
Schema-validate tool callsCheck tool arguments against strict schemas and reject anything outside expected ranges.
Set rate, spend and loop limitsCap tool calls, tokens and cost per task to contain runaway or abusive behavior.
Make consequential actions reversible where possiblePrefer drafts, staged changes and soft deletes so mistakes can be undone.

06 · NIST AI RMF: Manage

Runtime monitoring and policy

Pre-deployment testing cannot anticipate every input. Production behavior needs continuous oversight.

Define security policies explicitlyWrite down what agents may and may not do, in a form that can be evaluated consistently.
Record prompts, tool calls and decisions as security eventsCapture enough context to reconstruct what happened, with appropriate privacy protections.
Alert on anomalous behaviorUnusual tool use, permission errors, data-volume spikes and repeated policy hits deserve investigation.
Maintain a kill switchBe able to suspend an agent or revoke its credentials quickly without redeploying.

07 · NIST AI RMF: Govern

Audit evidence and governance

Governance requires evidence. Policies without records of how they were applied are difficult to defend.

Protect the integrity of security logsStore AI security events so they cannot be silently altered, and control who can access them.
Set retention for AI recordsAlign retention with legal, regulatory and investigative needs, and apply it consistently.
Map controls to your governance frameworkRelate agent controls to the frameworks your organization uses, such as the NIST AI RMF functions.
Document risk acceptanceWhen a known risk is accepted, record who accepted it, why and until when.

08 · OWASP LLM: Supply Chain

Models, plugins and supply chain

Agents depend on models, frameworks, plugins and tool servers that change outside your control.

Vet third-party models, plugins and tool serversReview provenance, permissions requested and maintenance status before connecting them to agents.
Pin versions and review changesTreat model, prompt and tool updates as changes that require testing before release.
Re-evaluate after upgradesA new model version can change behavior; re-run security tests before promoting it.

Testing and incident response

Security for agents is proven through testing and practiced response, not assumed.

Red-team agents before release and after material changeInclude direct and indirect prompt injection, data exfiltration attempts and permission abuse.
Keep a regression suite of attack casesRe-run known attack prompts automatically whenever prompts, tools or models change.
Add AI-specific scenarios to incident responsePlan how to investigate, contain and communicate an AI agent incident, including credential revocation.
Rehearse the responseRun tabletop exercises so the team can act quickly when an agent misbehaves.

Want a second set of eyes?

An AI security assessment reviews these areas against your actual systems, agents and data flows, and gives you prioritized recommendations.

Request a Security Assessment Schedule a Discovery Call