From assistant to acting system
An agent does more than answer questions. It breaks goals into steps, reads repositories, invokes tools, generates code and reacts to results. This can accelerate development, but it also connects model errors to real actions. Every added capability—from downloading a package to deploying software—expands the system's security boundary.
Prompt injection becomes an execution risk
Malicious instructions can hide in issues, documentation, web pages, test data or source-code comments. An agent may mistake that content for an instruction and expose secrets, install a hostile dependency or bypass a safeguard. External content must therefore be treated as untrusted data, never as executable authority.
- Separate context from commands
- Treat tool output as untrusted
- Keep secrets out of model context
Apply least privilege to tools and identities
Agents should reach only the repositories, commands and network destinations required for the current task. Short-lived credentials, read-only defaults and task-specific roles reduce the impact of mistakes. Builds, tests and analysis belong in isolated environments; production deployments and sensitive data stay separate.
- Short-lived, task-bound credentials
- Sandbox code and dependencies
- Allow network access explicitly
Require approval based on impact
Not every command needs human confirmation. Read-only analysis and local tests can run automatically, while changes to dependencies, permissions, production data or deployments require firm control points. The deciding factor is the possible impact of an action—not how harmless its wording appears.
- Classify actions by risk
- Use two-person review for sensitive changes
- Set stop conditions and resource budgets
Auditability makes autonomy operable
A secure agent records goals, tool calls, inputs, results and approvals in a tamper-resistant trail. Changes still pass through code review, tests, SAST, dependency scanning and secret detection. This keeps decisions reconstructable, supports incident response and lets teams improve policies using evidence from real behaviour.
- Capture complete action trails
- Keep existing secure-SDLC checks
- Evaluate agent behaviour continuously