AI agent security review before production access

An AI agent security review checks whether an assistant can access only appropriate data and perform only authorized actions. Review the complete workflow, including tools, identities, approvals, logs, and failure recovery. Passing a conversational demo is not sufficient evidence for granting production access to customer or business systems.

Write a task and data boundary

State the business purpose, intended users, input sources, and permitted output. List the data categories the agent needs and those it must not access. A callback-summary task rarely needs full payment history or unrelated personnel records. Define retention and deletion responsibilities for prompts, retrieved content, and execution logs. Identify the systems of record so a model-generated summary cannot silently become the authority for a customer status or a commercial decision.

Inspect tools and enforce least privilege

Inventory every tool, its authentication method, and the exact operations available. Test permissions with the identity the application will actually use. Separate read, draft, and write capabilities, and restrict access to the relevant records where possible. Validate arguments outside the model. Treat emails, documents, web pages, and customer messages as untrusted content. Embedded instructions in those materials must not override access policy or authorize the disclosure of sensitive information.

Review consequential actions and approvals

Specify which actions require a person and who may approve them. Present the exact proposed message, record change, or transaction with enough context for an informed decision. Tie approval to that action and invalidate it when material details change. Define what the agent does while waiting: it should pause or continue independent permitted work, not assume silence means approval. Keep a record of the decision without exposing unnecessary personal information in broadly accessible logs.

Demand evidence from adversarial and failure tests

Test cross-customer access, prompt injection in retrieved content, malformed tool results, stale records, duplicate requests, and dependency outages. Inspect both attempted and successful actions. Set release-blocking criteria for serious failures rather than averaging them away. Use NIST’s AI Risk Management Framework to organize risk ownership and monitoring. Record the tested configuration and known limitations so reviewers can distinguish demonstrated controls from claims that still need evidence.

Prepare revocation and incident response

Name an operator who can disable tool access and a backup who can continue the workflow manually. Test how credentials are revoked, pending actions are stopped, and affected records are identified. Measure time to detect and contain a failed scenario, not merely whether an alert exists. Start with limited users and permissions, then review real incidents before expanding. Production approval should be an accountable decision supported by evidence, with a clear path to withdraw access if conditions change.