# AI Agent Security Review Checklist: 30 Controls Before You Let an Agent Act > Source: https://netray.co/tools/ai-agent-security-review-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A 30-point security review for AI agents that can call tools and write to business systems, covering identity, permissions, prompt injection, data handling, and audit. ## Category ai-automation ## Tool **Kind:** checklist **Groups:** #### Identity and access **Items:** **Text:** The agent runs under its own service identity, never a shared or human user account **Critical:** true **Text:** Agent permissions are scoped to the minimum objects and transactions it needs **Critical:** true Agent credentials are stored in a secrets manager, never in prompts, code, or config files Credentials rotate on a defined schedule with an automated rotation path The agent cannot escalate its own privileges or modify its own permission grants Every downstream system enforces the end user's entitlements, not just the agent's #### Tool and action permissions **Items:** **Text:** Every tool the agent can call is explicitly registered; there is no open code execution **Critical:** true **Text:** Write and delete actions are separated from read actions and gated independently **Critical:** true High-impact actions (payments, order release, inventory posting) require human confirmation Financial and quantity thresholds cap what a single agent action can change Tool calls are rate limited per agent, per user, and per time window Destructive actions are reversible or paired with a tested compensating transaction #### Prompt and input security **Items:** **Text:** Untrusted content (email, web pages, supplier PDFs) is treated as data, never as instructions **Critical:** true **Text:** System prompts and tool definitions are isolated from user-supplied and retrieved text **Critical:** true Indirect prompt injection is tested with a documented red-team suite before each release Output that will be rendered or executed downstream is validated and encoded Input length, file types, and attachment sources are constrained and validated The agent refuses and logs requests that fall outside its declared scope #### Data handling and residency **Items:** **Text:** Data classification is defined for every source the agent can read **Critical:** true Export-controlled, ITAR, or CUI data never leaves the approved boundary or region Retrieval respects source-system permissions so users cannot see documents they lack rights to Prompts and completions containing sensitive data are excluded from vendor training Retention periods for prompts, completions, and traces are defined and enforced Personal data in prompts is minimized, masked, or tokenized before it reaches the model #### Monitoring, audit, and response **Items:** **Text:** Every agent action is logged with inputs, tool calls, outputs, and the initiating user **Critical:** true Logs are immutable, retained per policy, and forwarded to your SIEM Anomaly alerts fire on unusual tool-call volume, cost spikes, or refusal-rate changes A documented kill switch can disable the agent or any single tool within minutes AI-specific scenarios are included in incident response runbooks and rehearsed Model, prompt, and tool-definition versions are recorded with every logged action **Scoring Note:** Check an item only if it is true in production today and you could show evidence to an auditor. The eight critical items are the controls whose absence turns a helpful agent into a privileged, unlogged actor inside your business systems; any unchecked critical item should be remediated before the agent is granted write access, regardless of your overall percentage. Above 85% with all critical items checked is a reasonable bar for an agent that can change data. ## Content **Intro:** This free AI agent security review checklist gives security architects, IT directors, and enterprise AI teams thirty concrete controls to verify before an agent is allowed to call tools or write to business systems. It is written for organizations running AI alongside ERP, MES, CRM, and field service platforms, including defense contractors handling export-controlled data. The controls are grouped into identity, tool permissions, prompt and input security, data handling, and monitoring. Eight items are marked critical because their absence converts a helpful assistant into an unlogged privileged actor. Work through the list, evidence each check, and remediate critical gaps before granting write access. **Sections:** #### Why agents need a different review than chatbots **Body:** A read-only chatbot leaks information at worst. An agent that can call tools takes actions, and those actions inherit whatever permissions you granted it. The security question shifts from what the model might say to what it might do, and to who can trick it into doing that. Traditional application security assumes code paths are fixed; an agent chooses its own path at runtime based partly on text it read from an email, a supplier PDF, or a web page. That is why this checklist spends as much attention on tool scoping and untrusted content as on credentials, and why human confirmation on high-impact actions remains the single most effective control. #### The four failure patterns behind these controls **Body:** Every control on this list maps to one of four failure modes we see repeatedly in enterprise agent deployments, and none of them are exotic. Understanding which pattern a control defends against makes the individual checks far easier to prioritize when you cannot close everything at once, and it gives you language for explaining the risk to executives who have only seen the demo. **Bullets:** - Over-permissioned identity: the agent runs as an admin account because scoping was deferred, so any compromise is total. - Indirect prompt injection: instructions hidden in retrieved documents or inbound email redirect the agent's actions. - Permission bypass in retrieval: the vector store flattens source-system access controls and exposes documents to the wrong users. - Invisible actions: tool calls are not logged with the initiating user, so nothing can be investigated after the fact. #### How to use your score **Body:** Treat the critical items as pass or fail rather than as points. An agent with twenty-five of thirty items checked but no action logging is less defensible than one at twenty items with every critical control in place, because the first cannot be investigated when something goes wrong. Sequence remediation by blast radius: start with anything that lets the agent write, delete, or spend, then close identity scoping, then monitoring, then the hardening controls. Re-run the review whenever you add a tool, change the model, or expand the agent's data sources, because each of those changes the effective attack surface even when no code changed. #### How Netray secures enterprise AI agents **Body:** Netray designs and deploys AI agents for manufacturers and defense contractors where the data cannot leave the building. We run models on-prem or air-gapped, scope agent identities against Infor SyteLine, Infor LN, M3, ServiceMax, and Salesforce entitlements, and instrument every tool call so security teams get an auditable record tied to a real user. Our reviews include red-team testing for indirect prompt injection using your own document corpus, not generic samples. If you are preparing for a CMMC assessment or an internal audit of an agent already in production, we can produce the control evidence package alongside the remediation work. **Cta:** Book an AI agent security review with Netray and get an evidenced control assessment plus a prioritized remediation plan. **Faq:** #### What is indirect prompt injection and why is it the hardest control? **Answer:** Indirect prompt injection happens when instructions are hidden inside content the agent reads rather than typed by the user: a supplier PDF, a web page, or an inbound email. The model cannot reliably distinguish data from instruction, so no prompt-level fix is complete. The durable defenses are architectural: scope tools tightly, require human confirmation for high-impact actions, isolate retrieved content from system instructions, and log everything so an injected action is at least detectable. #### Can we just give the agent the same permissions as the user it serves? **Answer:** That is the right target and it is harder than it sounds. Most retrieval layers copy documents into a vector store and lose the source system's access control lists, so a user can retrieve content they could never open directly. Enforce entitlements at query time by filtering on permissions carried alongside each chunk, and have downstream systems evaluate the end user's rights on every write rather than trusting the agent's own service identity. #### How does this checklist apply to ITAR or CMMC environments? **Answer:** It applies in full, plus boundary constraints. Export-controlled technical data must stay inside your approved enclave, which usually rules out commercial API models and pushes you toward on-prem or air-gapped deployment. Logging requirements are stricter, retention is defined by policy rather than convenience, and the agent's data sources need documented classification. The critical items in this list map closely to CMMC access control, audit, and system integrity practice families. ## Search terms AI agent security checklist, LLM security review, prompt injection prevention enterprise, AI agent permissions, securing AI agents in the enterprise, AI agent audit logging, agentic AI risk controls --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json