AI agent security checklist: permissions, approvals, and audit

Start with the action boundary

An AI agent is different from a chatbot because it can take actions. Before connecting tools, define what the agent may read, create, change, send, purchase, publish, or delete. Separate reversible work from consequential actions.

Write acceptance criteria and stopping conditions for each workflow. An agent should know when it has finished, when it must ask for approval, and when it must stop because evidence is missing or a system behaves unexpectedly.

• List every system, data source, and action the workflow requires.
• Remove access that is convenient but not necessary.
• Separate read, draft, execute, publish, and delete permissions.
• Define actions that always require a human decision.
• Set a maximum time, usage, and financial budget.

Use least privilege and isolated identities

Give each agent only the credentials and scope required for its role. Shared administrator credentials make attribution difficult and increase the impact of a mistake. Prefer dedicated service accounts, scoped OAuth grants, and short-lived tokens where supported.

Separate computer sessions and browser profiles between employees or workspaces. Isolation prevents cookies, files, screenshots, and authenticated sessions from leaking between independent tasks.

Place approvals at consequential steps

Approval should happen immediately before an irreversible or externally visible action, not at every internal reasoning step. Common approval points include sending messages, publishing content, changing production systems, spending money, submitting legal forms, and deleting data.

The approval screen should show the proposed action, target, relevant context, expected effect, and cost. If the underlying action changes after approval, require approval again.

Keep durable evidence and audit history

A final message is not enough evidence that work happened. Store tool results, URLs, file identifiers, screenshots, timestamps, approvals, errors, and the identity that performed each action.

Evidence should survive reloads, worker crashes, and deployment replacement. It should distinguish live browser text from model-written summaries and distinguish file contents from terminal or screenshot labels.

• Record mission, agent, computer session, and workspace identifiers.
• Attach screenshots and artifacts to the relevant message or work card.
• Keep action inputs, outputs, errors, and approval decisions.
• Make retries idempotent so recovery does not duplicate external effects.
• Define retention and deletion policies for sensitive evidence.

Control cost and runaway execution

Security includes economic safety. An agent loop can consume models, searches, browser observations, and cloud-computer time without producing a useful result. Apply per-mission budgets, retry caps, idle shutdown, concurrency limits, and a hard stop.

Alert on unusual usage and separate successful workflow cost from failed attempts. Stop unhealthy computers instead of leaving them active after a mission has failed.

Test failure and recovery before rollout

Run controlled tests for expired credentials, blocked websites, rate limits, process termination, network failure, approval timeout, and deployment interruption. The system should fail closed when authorization or evidence is uncertain.

Verify that pause, resume, stop, takeover, and return-control operations preserve or terminate the correct session. Reopening the product should restore durable state without silently repeating actions.

A minimum production readiness gate

Before expanding access, prove one complete workflow with real evidence, one blocked approval, one hard-budget stop, one safe retry, and one recovery after interruption. Then test two independent agents concurrently to confirm isolation.

Security is an operating process, not a single launch checklist. Review permissions, incidents, failed workflows, and cost anomalies as the agent’s responsibilities change.