1. Inventory the authority
List each tool, data source, customer record type and business operation that an agent can invoke. Include the owner, downstream identity, data sensitivity and possible irreversible actions.
2. Separate instructions from authority
Model output is untrusted input to application control logic. An agent’s instruction does not constitute authorisation. Enforce policy server-side, validate arguments and apply object-level authorisation to every tool call.
3. Control identity and credentials
Use a distinct agent or workload identity where feasible, restrict privileges and credential lifetime, and capture the invoking user and delegated authority in the audit trail.
4. Require independent approval
Payment initiation, privilege elevation and destructive operations should require explicit policy and, where proportionate, a human approval step outside the model workflow.
5. Instrument response and shutdown
Log user and agent identities, policy decisions, tool requests and outcomes. Make agent workflows interruptible, with safe retry, rollback and emergency stop procedures.
Six questions for leadership
Which agents can act? Who is accountable for them? What data do they see? How is tool access restricted? What approvals are needed? Can operations stop and reconstruct an unsafe action?
Further reading: OWASP GenAI Security Project, NIST AI Risk Management Framework and the ASD ISM system access guidance.