Agent Security › Checklist
40 questions to ask before giving an AI agent access to your business, across identity, access, authority, limits, approval, guardrails, monitoring, other agents and containment.
AI agents are increasingly able to do more than answer questions. They can read files, use email, access CRMs, browse websites, call APIs, change records, run code and communicate with customers. And, depending on how they're configured, spend money, publish information or trigger other systems.
That capability is useful. But before an agent starts operating inside your business, there are some basic questions you should be able to answer. This checklist gives you a practical place to start.
You don't need to be a cybersecurity expert. You do need to know: who is the agent? What can it access? What can it do? Where does it need a person? Can you see what it's doing? Can you stop it?
This isn't a security certification. Passing every item doesn't mean an agent is "secure", and different organisations will need different controls depending on their systems, data, sector and regulatory requirements. Use it as a practical review. For every question, choose: YES (we have this covered), PARTLY (something exists, but it needs work), NO (we haven't addressed this yet) or NOT SURE (we don't know).
Pay particular attention to NOT SURE. Uncertainty about what an agent can do can itself be a problem.
1Does the agent have a clear name or identifier?
Avoid anonymous "AI automation" where possible. You should be able to identify which agent performed an important action.
2Does the agent have a clearly defined purpose?
Write its job in one or two sentences. If you can't clearly describe what the agent exists to do, defining appropriate permissions becomes much harder.
3Does the agent have a named human owner?
There should be a person responsible for reviewing the agent's purpose, access and authority. Not simply "IT owns it". Who specifically is responsible for this agent?
4Can you distinguish the agent's actions from a human user's actions?
Where possible, avoid having agents silently operate through shared human identities. If something happens, you should be able to determine: was that Sarah, or Sarah's agent?
5Is the agent recorded somewhere centrally?
As the number of agents grows, businesses need an inventory. At minimum record agent, purpose, owner, systems, authority, risk and status. Learn about AI Agent Registers.
6Do you know every business system the agent can access?
That might include email, cloud storage, CRM, database, accounting, Slack/Teams, website, GitHub, browser, APIs.
7Does the agent only have access to systems required for its job?
Apply least privilege. If a research agent doesn't need payroll, it shouldn't have payroll.
8Is access limited inside each system where possible?
Access to Google Drive doesn't necessarily need to mean every file in Google Drive. Access might be restricted to specific folders, records, accounts, projects, databases or fields.
9Are sensitive systems explicitly restricted?
Consider systems containing customer data, employee information, financial information, credentials, legal documents or confidential business information.
10Are the agent's credentials appropriately protected?
Where possible, the agent shouldn't need direct access to raw passwords, API keys, tokens or secrets. Give it the capability it needs without unnecessarily exposing the credential itself.
11Have you separated READ from CHANGE?
An agent that needs to see information doesn't automatically need permission to alter it.
12Have you separated DRAFT from SEND?
An agent can prepare an email without necessarily being authorised to send it.
13Have you separated PREPARE from SPEND?
An agent can prepare a payment without being authorised to execute it.
14Have you separated CREATE from PUBLISH?
An agent can create content without automatically making it public.
15Is DELETE treated as a separate authority?
Deletion deserves additional consideration because it may be difficult or impossible to reverse.
Level 1 READ, Level 2 RECOMMEND, Level 3 PREPARE, Level 4 CHANGE, Level 5 SEND, Level 6 SPEND, Level 7 PUBLISH, Level 8 DELETE. Higher isn't better. It simply represents more consequential authority. Learn about AI Agent Permissions.
16Are financial limits defined?
If the agent can spend money, define per-transaction limits, daily limits, approved suppliers, new supplier rules and escalation thresholds.
17Are external communication limits defined?
Consider approved recipients, approved domains, customer communication, supplier communication, bulk sending and attachments.
18Are data destinations restricted where appropriate?
An agent's ability to read sensitive information should be considered alongside its ability to send that information somewhere else.
19Are irreversible actions restricted?
Consider deletion, publishing, payments, production deployment, account closure and permission changes.
20Can the agent change its own authority?
For this question, NO is normally the answer you want. An agent should not generally be able to increase its permissions, raise its spending limit, disable monitoring, remove approval gates or create more powerful credentials.
21Have you identified actions requiring human approval?
Focus particularly on high-consequence actions.
22Is the correct person asked for approval?
Approval isn't useful if the approver doesn't have authority to make the decision.
23Does the approver receive enough context?
Don't ask someone to "approve Action 8371?". Tell them what the agent wants to do, why, what will change and why approval is required.
24Is the default response defined when nobody approves?
For consequential actions, no response should not silently become approval.
25Are approvals recorded?
Record action, agent, approver, time, decision and outcome. Learn about Human in the Loop for AI Agents.
26Have you identified which restrictions exist only in the agent's instructions?
Instructions are useful. But "never do X" is not necessarily the same as "the system prevents X".
27Are high-consequence boundaries enforced outside the model where possible?
Examples: payment limits, restricted systems, publishing approval, production access, external destinations.
28Are unnecessary tools unavailable to the agent?
If an agent should never perform an action, ask why it has the tool required to perform it.
29Can the agent disable its own security controls?
Again, NO is normally the desired answer. Security controls should be independent of the agent they govern.
30Are important boundaries preserved if you change AI model?
Your business security policy shouldn't disappear because you switch model provider. Learn about AI Agent Guardrails.
31Are important agent actions recorded?
Consider logging systems accessed, tools used, actions attempted, actions completed, approvals and blocked actions.
32Are denied actions recorded?
A blocked action can still tell you something important about agent behaviour.
33Can you identify unusual behaviour?
Examples: repeated denied actions, unexpected systems, new external destinations, unusual spending, large increases in tool use, unexpected operating hours.
34Can you trace important data movement?
For sensitive information, you may need to know what was accessed and where it went.
35Can you reconstruct what happened after an incident?
You should ideally be able to build a useful timeline without needing to guess what the agent did. Learn about AI Agent Monitoring.
36Do you know whether the agent can call other agents?
Agent-to-agent communication can create new authority paths.
37Is authority checked when one agent requests something from another?
Another agent asking does not automatically make the request authorised.
38Can one agent use another agent to bypass its own restrictions?
Imagine Research Agent is denied Finance access but Finance Agent is allowed. Can Research Agent simply ask Finance Agent for the information? If yes, the original restriction may not mean very much. Learn about AI Agent-to-Agent Security.
39Can the agent be paused quickly?
You should know how to stop autonomous activity when something unexpected happens. Ideally this shouldn't depend on asking the agent itself to stop.
40Can its access be revoked quickly?
Stopping the workflow may not be enough. Consider whether you can quickly revoke tokens, sessions, credentials, tools, connected systems and delegated authority. A stopped agent with active credentials may still leave unnecessary exposure.
For now, don't obsess over producing a perfect score. Look for patterns.
Mostly YES. You have considered many of the core controls. That doesn't guarantee security, but you have much better visibility over the agent's identity, access and authority. Continue reviewing the agent as its capabilities change.
Several PARTLY answers. You have some controls in place, but there are areas worth tightening before increasing the agent's autonomy. Prioritise high-consequence actions first.
Several NO answers. Your agent may have more access or authority than your current controls support. Start with identity, access, authority, human approval, monitoring and containment.
Several NOT SURE answers. This is particularly important. If you don't know what an agent can access, what it can do, where information can go, or how you would stop it, the first priority is visibility. You cannot meaningfully control authority you cannot see.
Agent security changes. A safe configuration today may look very different after someone adds another integration, changes the model, connects email, adds browser access, allows another agent to call it, increases autonomy or gives it permission to act externally.
Review the checklist when the agent is created, a new system is connected, its purpose changes, its authority increases, its owner changes, a significant model or platform change occurs, a security incident happens, and periodically while the agent remains active.
If 40 questions feels like too much, start here:
If you cannot answer those five questions confidently, start there.
This checklist comes back to one principle. An agent might technically be capable of sending an email, accessing a database, making a payment, publishing a webpage or deleting a record. That doesn't mean it should automatically have authority to do those things.
The goal of agent security isn't to make AI agents incapable. It's to make their authority deliberate. Give the agent the capabilities it needs. Give it the authority its job requires. Put boundaries around the rest.
We're building Agent Control to give businesses one place to understand the agents operating across their organisation. Instead of maintaining this information across spreadsheets, integration settings and different AI platforms, Agent Control is being designed around an Agent Register (which agents exist), identity (who is each agent), ownership (who is responsible), permission map (what can it access), authority (what can it do), approval gates (where it needs a person), monitoring (what it is actually doing) and containment (can you stop it).
Agent Control is in build, and so is the free interactive Agent Security Check. Leave your email and we will let you know when they are ready.
We're also turning this checklist into a free Agent Security Check. You'll answer a short set of questions about an agent's access, authority, data, tools, autonomy, human approval, monitoring and containment. The check will highlight the areas worth reviewing before you give the agent more autonomy. No scare tactics. No meaningless "100% secure" score. Just a clearer picture of where your agent has power and where you may need stronger controls.