What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Put authorization outside the model. Give each agent a distinct identity, task-scoped and preferably read-only access, and only the fields and records needed for its job. Keep credentials out of prompts and logs, isolate context and memory, constrain tool arguments and network destinations, and independently verify approval for sensitive actions. Test these controls at the tool-execution boundary—not just by checking whether the agent says it will comply.
Where sensitive data can leak
An agent connected to a SIEM, EDR, vulnerability-management platform, identity system, or other security tool can expose data through more than its final answer. Relevant paths include tool requests, returned records, prompts and context, persistent memory, credentials, application or protocol logs, and outbound connections. A prompt injection in an alert or retrieved document can try to redirect a permitted investigation toward unauthorized queries or exfiltration. Broad permissions make that attempt more consequential.
OWASP’s AI Agent Security Cheat Sheet and OWASP MCP Top 10 identify risks including prompt injection, tool misuse, secret exposure, scope creep, and context over-sharing. Treat each path as a separate control surface; filtering prompts alone does not establish an authorization boundary.
Where should authorization be enforced?
Enforce policy in a trusted tool-execution component, such as authorization middleware or a service that brokers queries to the security platform. The model may propose an action, but it must not grant itself access. Check every call against the agent’s identity, task, permitted operation, target resource, and time window. A missing or invalid policy decision should deny the call.
#1 Best Overall
Give the agent a distinct identity or equivalent workload identity rather than automatically inheriting the full permissions of the human who started it. Scope access per tool and resource, and default to read-only when investigation is the task. OWASP recommends granting only the minimum tools needed and controlling read/write and resource scopes outside the agent context.
| Decision | Safer design | Riskier design |
|---|---|---|
| Identity | A distinct agent or workload identity with attributable calls | Unconditionally using a human’s broad inherited permissions |
| Tool access | Allowlisted tools and task-specific resource and operation scopes | General access to a platform or arbitrary tool selection |
| Authorization | A trusted execution layer checks every call and denies unknown or invalid requests | Relying on the model prompt or the agent’s stated intent |
| Data returned | A trusted service returns only necessary records and fields | Passing full event payloads or broad query results into context by default |
| Credentials | Short-lived, narrowly scoped credentials managed by the runtime | Long-lived keys in prompts, memory, or plain-text logs |
How can the agent investigate without seeing everything?
Put a trusted service between the agent and the security platform. Let the service enforce query scope and return a task-specific result rather than exposing unrestricted platform access. For example, an investigation may need a small set of alert fields or a limited time range, not the raw event stream or every related identity record. The exact fields depend on the task; there is no universal redaction scheme established by the reviewed guidance.
- Define which records and fields each task needs before enabling its tool.
- Redact or transform identifiers and secrets when exact values are not necessary to complete the task.
- Keep raw logs, full event payloads, and credentials out of prompts by default.
- Return bounded results and reject queries outside the caller’s approved scope.
This reduces the amount of sensitive material available to be repeated in an answer, retained in context, or forwarded through another tool.
Rank #2
How should untrusted content and tool calls be handled?
Alert text, ticket descriptions, retrieved documents, API responses, and MCP tool descriptions are data—not trusted instructions. Any of them may contain text intended to steer the agent. Keep system instructions structurally separate from retrieved content, but do not treat that separation or a prompt filter as sufficient protection. Validate tool arguments and enforce the allowed operations at execution time.
Recommended Free Tools
- Constrain query parameters, target resources, and result limits in the tool service.
- Allow only reviewed tools; examine their descriptions and behavior when they are added or changed.
- Restrict outbound network destinations so an agent cannot send data to arbitrary endpoints.
- Reject malformed, out-of-scope, or policy-ambiguous calls rather than asking the model to decide whether they are safe.
OWASP’s Secure Coding with AI Cheat Sheet and MCP Top 10 discuss argument validation, tool poisoning, and egress restrictions as relevant safeguards.
How do you protect credentials, memory, and sessions?
Credentials
Do not place long-lived API keys or tokens in model context, persistent memory, or protocol logs. A trusted runtime should supply a short-lived credential scoped to the required platform and operation. Limit access to the secret store, and revoke or rotate the credential when the task ends or compromise is suspected. OWASP recommends sandboxing and ephemeral credentials for MCP and coding-agent environments.
Memory and context
Separate memory and active context by user, tenant, and task. Do not let a session inherit another session’s context unless a separate authorization decision permits it. Before persisting content, minimize and validate it; set retention and size limits; and audit stored memory for sensitive data. OWASP recommends memory isolation and expiration, while the OWASP MCP Top 10 identifies context over-sharing across tasks, users, or agents as a risk.
When should a person approve an action?
Separate investigation from execution. Require independent approval for sensitive or high-impact actions, then verify that approval in the execution component against the exact actor, operation, target, and parameters. A generic approval, or a human click that the tool service does not validate, is not an effective execution control.
Keep an audit trail with structured metadata: identity, policy decision, tool, scope, target, and outcome. Redact secrets and sensitive payloads rather than recording them in plain text. This preserves evidence of what happened without turning logs into another store of credentials or personal data. OWASP recommends structured decision metadata and controls for high-risk actions, and cautions against plain-text logging of PII and credentials.
How should these controls be tested?
Test the enforcement layer directly before production and after material changes to prompts, tools, memory, retrieval, policy, or providers. Include both direct and indirect attacks, and verify the result at the tool boundary rather than relying on the model’s verbal refusal.
- Place malicious instructions in an alert, document, API response, or tool description and check whether the agent can exceed its task scope.
- Attempt unauthorized tool use, privilege escalation, and queries for resources outside the approved identity and task.
- Check for cross-user or cross-session leakage through context and persisted memory.
- Look for secrets in prompts, outputs, and logs, and test attempts to send retrieved data to disallowed destinations.
- Confirm that missing policy decisions and invalid or mismatched approvals fail closed.
OWASP’s abuse-case matrix covers prompt override, tool misuse, privilege escalation, memory poisoning, and data exfiltration. Keep repeatable cases so changes can be checked against the same failure modes.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What guidance is available, and what is still in progress?
CISA’s May 1, 2026 announcement says CISA and partners released Careful Adoption of Agentic Artificial Intelligence (AI) Services. Its summary emphasizes limiting autonomy and access, especially for sensitive data and critical systems, alongside layered defenses, identity management, oversight, threat modeling, monitoring, and regular assessment.
Best Value
- Enterprise-grade prevention, detection, correlation and response from the perimeter to the endpoint with our Total Security Suite.
- Gain critical insights about network security, from anywhere and at any time, with WatchGuard Cloud.
- Built-in compliance reports, including PCI and HIPAA, mean one-click access to the data you need to ensure compliance requirements are met.
- Up to 18 Gbps firewall throughput. Turn on all additional security services and still see up to 2.4 Gbps throughput.
On February 5, 2026, NIST’s National Cybersecurity Center of Excellence (NCCoE) announced a concept paper on software-agent identity and authority. The project’s stated topics include identification, authorization, auditing, non-repudiation, and prompt-injection controls. NCCoE’s resource hub describes an active project intended to produce implementation resources and an SP 1800 series practice guide; the hub reported more than 600 responses to the concept paper. That is a response count, not a measure of security effectiveness. The reviewed hub describes an intended deliverable, not a final published guide.
OWASP, NIST, and CISA guidance can inform design and review, but it is not a certification or a guarantee that an agent deployment is secure. When evaluating an implementation, compare permission granularity and expiry, identity attribution, context exposure, isolation, outbound restrictions, approval and recovery mechanisms, audit quality, and the repeatability of abuse-case tests. The guidance cited here does not establish a comparison of named vendors or products.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
