Agentic AI Security: Five Questions Before You Give an Agent Tools

An AI assistant that can answer questions is different from an agent that can read files, call APIs, send messages, modify records, or trigger workflows. As autonomy increases, identity and authorization become central design decisions. The distinction matters more than most procurement conversations reflect: a chatbot that gives bad advice is an embarrassment, while an agent with write access that acts on bad advice is an incident.

1. What identity does the agent use?

Avoid treating an agent as an invisible extension of a human user. Define whether it has its own service identity, delegated permissions, or task-scoped credentials, and make those decisions auditable. This decision should be made deliberately, in writing, before the agent goes live—not discovered during an incident investigation.

2. What is the minimum action set?

Give the agent only the tools and permissions required for its task. Separate read from write actions, and use stronger approval requirements for destructive, financial, external-communication, or high-impact operations.

3. What data can enter the model context?

Map sensitive data flows, retrieval sources, prompts, logs, tool outputs, and third-party model boundaries. Context can become a data-exposure pathway if it is assembled without classification and access controls.

4. How are untrusted instructions handled?

Agents can encounter instructions embedded in documents, web content, messages, and tool responses. Design the system so untrusted content cannot silently redefine goals, expand permissions, or override policy.

5. Can you reconstruct what happened?

Logging should capture material actions, tool calls, authorization decisions, approvals, errors, and outcomes at a level appropriate to the risk. Incident response is much harder when autonomous activity cannot be reconstructed.

There’s no single control that makes agentic AI secure. It comes from combining identity, least privilege, data boundaries, instruction trust, approval design, and observability. Most agentic AI failures we’ve seen trace back to one of these five questions being answered by default rather than by design.