AI agent security: permissions, secrets, and control
A practical guide to AI agent security covering least-privilege access, secret and data protection, isolated environments, and approval for critical actions.
Minimal permissions
Do not connect every service upfront. Give the agent only the access required for a validated workflow.
Secrets and data
Keep tokens and keys separate from public instructions. Do not send regulated data to an unsuitable model or integration.
Approve critical actions
Payments, publishing, and irreversible changes should stay behind human approval. Automate preparation while keeping control of the final step.
Threat-model one workflow
List the data, tools, external recipients, and irreversible actions involved. Define what the agent may read, what it may change, and where approval is required. This is more useful than a generic safe-mode label because controls map to actual work.
Treat instructions found in external content as untrusted data. An email, webpage, or file can attempt to redirect the agent. System rules and tool boundaries must take precedence over source text.
- Data
- Tools
- Recipients
- Irreversible actions
Tests before automation
Test denied access to an unrelated source, malicious instructions, secret exposure in logs, and integration failure. Keep explicit human approval for payments, publishing, deletion, and permission changes.
- Least-privilege test
- Prompt-injection test
- Secret redaction
- Safe failure
Primary sources
Verify changing capabilities and requirements against developer documentation and industry standards.
Try it on your own workflow
Launch OpenClaw or Hermes Agent in an isolated PawClaw.ai cloud environment.
Launch an AI agent