Agent Security Hardening

Harden the boundaries where an agent turns untrusted data into filesystem, network, memory, or tool actions. Produce concrete controls and tests for the framework being reviewed; a checklist without enforcement evidence is incomplete.

Important

• Treat model output, retrieved content, tool output, memory, and cross-agent messages as untrusted input.
• Default external integrations to read-only and grant each write capability separately.
• Validate at the action boundary even when an upstream prompt or schema already validated the value.
• Fail closed before a side effect when identity, destination, ownership, or containment cannot be proven.
• Before a delete, publish, credential rotation, or other irreversible action, the real tool entry point must authorize the authenticated principal for that exact operation and resource scope, then require explicit confirmation or a valid scoped pre-approval. Missing or invalid evidence blocks the action.
• Use hard bounds defined by the governing requirement and stricter values verified from deployment configuration. When neither defines a value, mark it as a required decision and test that the implementation rejects an unbounded configuration; do not invent a plausible value.

When to Activate

• Building an autonomous agent, tool gateway, memory service, or agent-to-agent protocol
• Reviewing code that maps model output into commands, paths, URLs, credentials, or API mutations
• Isolating tenants, projects, sessions, or workspaces in a long-running agent process
• Hardening temporary files, logs, tool responses, or external-content ingestion