Free resource · 16 controls · MIT / CC BY 4.0
The AI Agent Security Checklist
A practical control checklist for teams shipping LLM agents, the kind with tool access, credentials, and the ability to take real actions on real systems. Every control states what to check, why it matters, how to test it, and what the hardened version looks like in real configuration or code. Mapped to OWASP’s Top 10 for Agentic Applications and Top 10 for LLM Applications, MITRE ATLAS, and NIST’s AI Risk Management Framework. That makes findings here citable in an enterprise security questionnaire, not just useful in a design review.
How to use this
Shipping an agent in the next month? Work the nine Baseline controls below first. They cover the mechanism that turns a successful prompt injection into an incident rather than an annoyance: a scoped credential, a validated tool argument, and a human approval gate on anything that writes.
Answering a security questionnaire? Each control’s framework mapping gives you a citable identifier: an OWASP ASI or LLM risk, a MITRE ATLAS technique, or a NIST AI RMF subcategory, rather than a vague claim of "we thought about AI security."
Reviewing someone else’s system? Every control’s “How to test” section is written to be executable by a reviewer who did not build the thing and cannot ask the person who did.
Baseline: start here
The controls that turn a successful attack into a non-event instead of an incident.
| TOOL-01Tool authorization | Agent credentials are scoped to the tools the agent actually uses |
|---|---|
| TOOL-02Tool authorization | Tool arguments are validated in code, and the model never supplies the target |
| IDN-01Identity & blast radius | The agent does not share a credential with a human or an application |
| INP-01Prompt injection | All content from outside the agent’s workspace is treated as adversarial |
| INP-02Prompt injection | A trust boundary separates ingesting external content from taking privileged action |
| HIL-01Human-in-the-loop | Production writes and infrastructure changes are gated on human approval |
| OBS-01Observability | Tool calls, arguments, and results are logged well enough to reconstruct an incident |
| RES-01Resilience & abuse | Loop, spend, and rate limits bound the blast radius of a misbehaving agent |
| OUT-01Output handling | Model output is never rendered or executed downstream without contextual encoding |
Intermediate
Once agents handle real customer data or write operations.
- IDN-02
Agent actions are attributable to a distinct identity in downstream logs
Identity & blast radius
- HIL-02
- DAT-01
Network egress is restricted where the agent touches sensitive data
Data flow & retention
- DAT-02
- MEM-01
- SUP-01
- OBS-02
Detection exists for abnormal agent behavior
Observability · Advanced
Want someone else to run this against your system?
This checklist is what a self-review looks like. An AI Security Review is what it looks like when I run it against your actual agent, with findings ranked by exploitability and hardened-by-example fixes, in three weeks.