Before an AI agent can access company data, verify who or what it acts as, what it can reach and change, how it handles information, and whether you can stop and investigate it. A successful demo or a system-prompt instruction is not an access control. Approve only the narrow task-specific scope that passes documented tests, and block or reduce access when a required control fails.
Here, an “audit” means a practical security and governance review—not a formal financial audit, legal certification, or assessment of every agent on the market. The steps below turn the question “What should we check before an AI agent can access company data?” into a repeatable pre-access decision.
Set a clear go/no-go gate
Define the conditions the agent must meet before it receives access. A practical gate has three outcomes: go for the tested, restricted scope; go with limits when a narrower configuration passes; or no-go while a failed control is corrected. Do not treat unresolved high-impact risks as an informal exception.
- Go: An accountable owner and attributable agent identity are in place; effective permissions are limited to the task; realistic misuse tests show that prohibited actions are blocked; data handling and retention meet organizational requirements; and monitoring, approval, revocation, and shutdown have been tested.
- Go with limits: Remove an unnecessary tool, data source, write operation, or user group, then repeat the relevant tests against the reduced configuration.
- No-go: The acting identity or authority cannot be determined, a sensitive action can bypass authorization or required approval, data can escape through an ungoverned path, or operators cannot reliably investigate and contain an incident.
This is an operational decision framework, not a universal certification scheme. Microsoft’s implementation guidance and OWASP’s community cheat sheet offer control principles, but neither is an audit of your particular deployment. Apply them to your own identity, cloud, agent, and data systems. Microsoft’s least-privilege guidance and the OWASP AI Agent Security Cheat Sheet are useful starting points.
Recommended Free Tools
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
1. Who owns the agent, and what is it allowed to do?
Create an inventory record for each agent before connecting it to business data. The record should make the use case and accountability concrete, including what the agent is forbidden to do—not just what a team hopes it will do.
- Business purpose, accountable person or team, environment, platform, and lifecycle state.
- Model and version; connected tools, plugins, protocols, retrieval sources, and data stores.
- Agent identity, user or delegation mode, and the systems in which that identity is recognized.
- Permitted user task and explicit prohibited operations, such as exporting an entire repository, changing permissions, deleting records, or sending external messages.
- Owner of each connected system and the person authorized to approve access or exceptions.
A display name or a conversation transcript alone does not establish which principal performed an action or whose authority it used. Microsoft recommends lifecycle-managed agent identities and organizational agent registries; its advice is implementation guidance within Microsoft’s ecosystem, so map the principles to the stack you actually use. Microsoft’s organizational governance guidance describes registry and ownership practices.
2. What authority does the agent have across the full request path?
Map one representative request from the user through the orchestrator and model to each tool or API, downstream service, and data store. Record the identity, role, token or scope at every hop. Check whether the downstream service re-authorizes the action, and whether the resulting activity is attributed to the user, the agent, or both.
Review effective access across connected tools and systems, not each permission in isolation. Several individually narrow grants can combine into broad authority—for example, reading records in one system and sending messages through another may enable an agent to export information even if neither permission looks excessive on its own.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Use a distinct, lifecycle-managed identity for the agent where the platform supports it; avoid relying on a human’s broad credentials without a clear delegation and attribution model.
- Grant only task-specific resource and action scopes. Separate read from write, and scope access to the relevant records, folders, mailboxes, projects, or databases.
- Prefer short-lived or just-in-time elevation over standing access when elevated permissions are genuinely needed.
- Confirm that authorization is enforced by the tool or downstream service, not only by the model or its instructions.
These checks follow the end-to-end authorization and identity principles in Microsoft’s guidance on least privilege for AI agents. The goal is to answer not merely “What permissions were configured?” but “What can this identity actually cause across the systems it can reach?”
3. Which tools and actions should be enabled?
Inventory every callable tool and the operations it exposes. Remove capabilities that the use case does not require; deny by default rather than giving the agent a broad toolset and asking it to exercise restraint. Where possible, enforce restrictions in a policy layer or downstream service so a natural-language response cannot override them.
- Separate read, create, update, delete, permission-change, and external-send operations.
- Scope each operation to the required resources; a read-only role across an entire tenant may still be too broad.
- Use explicit allowlists for sensitive operations and deterministic validation of parameters, destinations, and affected records.
- Require a person to approve high-impact actions before execution, with enough context to understand what will happen.
- Verify that the downstream service independently enforces the authorization decision.
For example, an agent that drafts a reply may need to read one support case and prepare a message, but not send it, alter account permissions, or search unrelated customer records. Restricting the available operations is stronger than relying on a prompt to ask the agent not to use them. See Microsoft’s agent-risk guidance and the OWASP security cheat sheet.
4. Can hostile instructions make it perform a forbidden action?
Test both direct instructions from users and indirect instructions embedded in emails, documents, web pages, retrieved records, memory, and tool results. The relevant question is not only whether the agent says it will resist; test whether authorization and tool controls prevent the attempted action from succeeding.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Choose a benign task the agent is authorized to perform, such as summarizing a permitted record.
- Place an untrusted instruction in content the agent may encounter. Ask it to disclose data, change a record, broaden access, or send information to an external destination.
- Check the agent’s response and the system outcome: tool calls, authorization decisions, data returned, and any attempted or completed side effect.
- Repeat with different wording and placement, including multiple attempts. Vary the source and form of the untrusted content.
- Rerun relevant tests after changes to the model, prompt, tool schema, permissions, or data sources.
NIST’s Center for AI Standards and Innovation (CAISI) says it added database-exfiltration, code-execution, and phishing scenarios to its agent-hijacking evaluations and frequently induced agents to follow malicious instructions in those areas. The article gives a qualitative finding, not a universal production failure rate. Its practical value is to show why realistic, repeated tests matter—not to predict how a particular deployed agent will perform. CAISI describes the underlying risk this way: “AI agent hijacking is the latest incarnation of an age-old computer security problem that arises when a system lacks a clear separation between trusted internal instructions and untrusted external data — and is therefore vulnerable to attacks in which hackers provide data that contains malicious instructions designed to trick the system.” The NIST technical staff article was published January 17, 2025: Strengthening AI Agent Hijacking Evaluations.
5. Where can business data go, and how long does it remain?
Trace information beyond the source the agent reads. Data can be exposed through generated outputs, persistent memory, platform retention, logs, and downstream actions as well as direct access. Document the path for the data classes in scope and check each destination against organizational requirements.
- Which records, files, and fields can the agent retrieve? Are access controls and cross-user or cross-tenant boundaries preserved where relevant?
- What content enters conversation context or persistent memory, and who can retrieve it later?
- What does the platform retain, for how long, and how are deletion requests handled?
- What sensitive content may appear in logs, generated answers, tool parameters, or downstream systems?
- Can connected tools transmit data outside the organization or to a broader audience than the source system permits?
- What output restrictions, redaction, or destination controls are needed for the use case?
Set these rules before access is granted; do not assume that restricting source permissions alone controls later use of retrieved content. Microsoft specifically warns about leakage through outputs, logs, memory, and downstream actions and recommends governing access, retention, and output. See Microsoft’s guidance on reducing autonomous agentic AI risk and its organizational governance guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Which dependencies can change the agent’s behavior?
Record the models, plugins, tools, protocols, retrieval sources, and other components that can affect instructions, data, or actions. Assign owners, record versions, and define who may approve changes. Treat changes to prompts, models, tool schemas, permissions, and grounding data as security-relevant; a previously passing test does not automatically cover a changed system.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
- Identify the components that can add instructions, supply retrieved content, or execute actions.
- Keep a version and owner record for each dependency, with a controlled change path.
- Specify which authorization, injection, data-path, and approval tests must be repeated after a change.
- Isolate components where practical so a change or compromise has a limited reach.
These practices apply the supply-chain and change-governance concerns in Microsoft’s agent-risk guidance; the specific review triggers and approval process should fit the organization’s systems and risk tolerance.
7. Can people oversee, investigate, and stop it?
For high-impact actions, make approval meaningful: a reviewer should see the proposed action and enough context to decide whether it is appropriate. During execution, provide status where needed; afterward, retain a useful event record. Test the controls rather than accepting a vendor feature description as proof they work.
- Verify that logs connect the agent identity, user or delegation context, permission scope, tool call, safe representation of relevant parameters, downstream authorization result, and outcome.
- Confirm that operators can reconstruct the underlying tool actions; a final chat answer by itself will not show which records were read or what side effects occurred.
- Exercise pause and stop controls, credential revocation, token invalidation, and credential rotation.
- Check that revoking or disabling the agent also contains access in connected services and does not leave usable downstream credentials behind.
- Define who reviews alerts and logs, who can contain the agent, and how incidents are escalated.
Microsoft’s guidance covers lifecycle-managed identities, authorization, logging, and revocation; its risk guidance also addresses oversight and intelligibility. Use the references as implementation guidance, then verify behavior in your own environment: least privilege and agent identity and agent-risk controls.
8. Record the decision and set a review trigger
Keep a decision record that another reviewer can use to understand what was approved and why. It should name the accountable owner, approved scope, excluded data and actions, approvers, test cases and results, monitoring plan, rollback or disable procedure, unresolved risks, and a review or expiration date.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Block access or narrow the scope if a required control fails. Reassess after material changes to the model, prompt, permissions, tools, integrations, or data sources, and on a defined access-review schedule. The sources provide control principles rather than one universally correct review interval; set the cadence to match the sensitivity of the data and the rate of change in the deployment.
NIST announced a concept paper in February 2026 concerning identity and authority of software agents as a potential standards-oriented project. It is not a finished standard or certification, so use it as evidence that these questions remain active—not as a substitute for your organization’s access decision. NIST’s announcement on the concept paper.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
