Agentic AI Security Checklist: 12 Checks Before You Deploy an AI Agent

Agents change the security model

An AI agent is not a chatbot with better autocomplete. It can invoke tools, change state, and act across your infrastructure. That means the security boundary moves from the model to everything the agent can touch.

1. Inventory every tool the agent can call

If you cannot enumerate the tools, you cannot secure them. Maintain a registry of every function, API, and shell command an agent may invoke.

2. Enforce least privilege per tool

Give each tool the minimum scope needed. A calendar agent should not have write access to billing systems.

3. Treat agent output as untrusted

Model output can be influenced through prompt injection via tools and retrieved content. Never execute agent output without validation.

4. Add human-in-the-loop gates

Require approval for irreversible actions: deleting data, spending money, changing access, releasing to production.

5. Scope MCP servers tightly

Model Context Protocol servers extend what an agent can see and do. Authenticate, rate-limit, and sandbox every MCP endpoint.

6. Log everything the agent does

Action logs are your forensic source for incident response. Log tool calls, parameters, outcomes, and the model request that triggered them.

7. Separate per-user context

Never let one shared agent session leak between users. Isolate conversations, tool results, and permissions per principal.

8. Handle secrets outside the prompt

Do not put credentials in prompts. Retrieve secrets through a scoped runtime that the model cannot exfiltrate.

9. Sanitize retrieved context

Documents, web pages, and messages fetched into context are injection vectors. Strip instructions, limit length, and monitor for embedded directives.

10. Monitor for prompt-injection triggers

Watch for suspicious instructions in user and retrieved content. Alert when agent behavior changes following foreign input.

11. Run red-team drills

Test your agent under attack: prompt injection, tool misuse, context poisoning, permission escalation. See the agentic security section for a full attack model.

12. Plan for agent incident response

Define how you contain a compromised agent, revoke its tool universe, and replay its decisions. Automation speeds both compromise and response.

Wrap-up

Agents multiply capability and risk at the same rate. The checklist above turns a vague threat model into concrete deployment gates. Deep-dive each control in the agentic AI security reference on this site.