AI Agent Security Checklist for Production Deployment

An AI agent introduces security questions that a normal chat interface does not. It may retrieve private context, call tools and trigger real actions. Production safety therefore depends on the complete workflow: identity, permissions, data handling, validation, approvals, monitoring and recovery—not on the model prompt alone.

Create a threat model for the workflow

List the users, data sources, external inputs, tools and possible actions. Consider accidental misuse, malicious instructions, compromised documents, excessive permissions and failures in connected systems. Rank scenarios by business impact and reversibility so the strongest controls protect the most consequential paths.

Apply least-privilege tool access

Give the agent only the operations required for its defined job. Separate read and write tools, scope credentials to the user or workflow and avoid sharing powerful service accounts across unrelated agents. Permissions should be enforced by the tool layer even if the model requests something broader.

Treat retrieved content as untrusted input

Emails, web pages and documents may contain instructions designed to redirect the agent. Separate system rules from retrieved content, restrict which tools are available in each step and validate tool arguments outside the model. Sensitive actions should never depend on one unconstrained generated response.

Protect data and secrets

Minimise the personal or confidential data sent to models, document provider retention settings and redact unnecessary values. Secrets belong in managed credentials rather than prompts, logs or retrieval indexes. Define which information may cross regions, vendors and organisational boundaries before launch.

Require approval for consequential actions

Payments, deletions, external messages, account changes and high-impact decisions need explicit confirmation or a human review queue. Show reviewers the proposed action, source evidence and relevant context. Approval should happen as close as possible to the actual execution step.

Log, monitor and rehearse recovery

Record tool calls, permission decisions, approvals, model and prompt versions, errors and important outputs while respecting privacy. Monitor unusual action patterns and repeated failures. Define how to disable the agent, revoke credentials, correct downstream records and investigate an incident before one occurs.