Agentic AI changes the security rules
These systems act, decide and learn with little human input. That creates risks a simple perimeter setup will miss. I wrote this for people running infrastructure or choosing tools who need to harden autonomous systems without buying the hype.
The useful part is the controls. Map what the agent can touch, limit the damage it can do, and keep a clean record of what happened when it goes wrong.
Map the agent’s attack surface and threat model
Treat each agent like a service with a set of capabilities. List what it can read, what it can change, which systems it can call and which credentials it holds. That list is the attack surface.
Inventory capabilities
- Network access: which internal APIs and external endpoints can the agent reach?
- Privileges: can it rotate secrets, create users, or deploy code?
- Persistence: where does it store long-term state? File store, database, or object storage?
- Learning channels: does it accept external data for on-the-fly retraining?
Concrete examples
- An agent that can push code to CI/CD needs a strict, limited deploy token. Do not give it full repo admin rights.
- An agent that queries HR data should have a read-only view with column-level filtering on personal identifiers.
- An agent that calls external webhooks should go through a proxy so you can log and throttle requests.
Threats to model
- Confused deputy attacks where the agent is tricked into acting on behalf of an attacker.
- Prompt injection and data poisoning if the agent accepts free-form input or external plugins.
- Privilege escalation when temporary tokens are requested and not revoked.
- Lateral movement from networked agent hosts into internal services.
Quick checks
- Run a capabilities audit: map each agent to the smallest set of network endpoints and credentials it needs.
- Simulate a compromised agent: revoke its token and check that it fails safely.
- Probe prompt channels with malicious payloads to test input sanitisation.
Design decisions
- Use least privilege by default. Tokens should be tightly scoped and short-lived.
- Keep agent state immutable where you can. Immutable snapshots make forensics easier.
- Send all outbound traffic through an egress control point. That gives you allow-lists and logging.
Controls, governance and operational hardening for UK enterprises
Defend the full lifecycle. That means design-time constraints, runtime controls, and post-incident investigation. Put governance in place that ties technical controls to roles and audits.
Technical controls
- Credential handling: store secrets in an HSM or cloud KMS. Do not hard-code secrets in agent code or containers.
- Capability sandboxing: run agents in restricted runtimes. Use OS-level namespaces, seccomp filters, or purpose-built agent sandboxes. Limit syscalls and file system access.
- Network-level policies: enforce zero-trust access between agents and backends. Use identity-aware proxies and service meshes to authenticate calls.
- Behaviour containment: implement circuit breakers. If an agent exceeds defined patterns—burst requests or unexpected external hosts—kill the flow and alert a human reviewer.
- Rate limiting and quotas on actions that materially change state. Limit the blast radius.
Operational practices
- Human gating: require a human approval step for high-impact actions. Make approvals auditable and time-bound.
- Canary and staging gates: run agents first against synthetic or scrubbed data. Measure decisions against expected outcomes before promoting to production.
- Monitoring and observability: collect structured logs for prompts, decisions and API calls. Correlate prompts with downstream actions for traceability.
- Canary tokens: plant decoy resources that trigger alerts if agents try to access them. That gives an early signal of malicious behaviour or drift.
Governance and process
- Role definitions: separate prompt writing from permission approval. One person writes prompts; another reviews access scopes and deployment.
- Change control: require a documented risk assessment for agents that can act on critical assets. Keep versioned artefacts: prompt versions, policy versions, and model snapshots.
- Incident playbooks: define the steps to quarantine an agent, revoke credentials, replay logs and restore services. Practice the playbook with tabletop exercises.
- Audit trails: keep all approvals and deployments logged and retained at the level needed for compliance checks.
Controls you can put in place in weeks
- Enforce short-lived credentials via an identity broker. Rotate tokens every few minutes for autonomous agents that act without human presence.
- Add a prompt filter at the gateway. Block or flag prompts that request credential theft, lateral movement or code execution.
- Run a simple canary: create a fake API endpoint and monitor agent access. If hit, trigger an automated revocation and an incident ticket.
Testing and verification
- Use adversarial testing. Feed malicious prompts and malformed data to agents and measure responses.
- Run decision audits on a rolling sample of actions. If drift exceeds thresholds, withdraw production access.
- After an incident, capture memory and filesystem snapshots from the agent host and preserve model and prompt state. That speeds up root-cause analysis.
Agentic AI needs capability control, not just perimeter controls. Treat agents like privileged services. Limit what they can do, log what they do, and build fast kill switches. Use sandboxing and short-lived credentials to cut the blast radius, and keep the governance tight enough to hold up when something breaks.
