Agent security assumes every model-visible input and tool result may be hostile. Protect systems with identity-bound context, least-privilege tools, deterministic policy, output validation, approval, isolation, restricted egress, scoped credentials, auditable effects, and adversarial evaluation. Prompts influence behavior; they do not create a security boundary against injection or compromised tools.
You will build a threat model and map each threat to preventive, detective, and recovery controls.
User text, retrieved pages, files, emails, web results, tool output, model output, skills, plugins, and MCP servers are untrusted. Authenticated identity, tenant scope, policy, secrets, and authorization decisions come from trusted host systems—not from those inputs.
Minimize secrets in the workspace, proxy external access, restrict destinations, scan outputs, cap data volume, require approval for new destinations, and monitor unusual tool sequences. Once a model can read a secret and access arbitrary network output, a prompt cannot reliably prevent exfiltration.
Failure injection: Place a canary secret in a forbidden file and an injected request in an allowed document. Confirm file policy, egress control, output scanning, and alerts all work independently.
Create a threat model with assets, actors, entry points, trust boundaries, abuse cases, controls, residual risk, and test IDs. Run a tabletop prompt-injection incident.