AI agent security: permissions, sandboxes, and approvals
AI agent security controls what the application can read, change, and send. A tool-using agent can process private data, use credentials, and change external systems. Its allowed actions need checks in code, even when the model’s answer looks safe.
Expose only the tools the task needs. Check permissions before each tool call, isolate execution, limit credentials, and record the result. Require approval for high-impact actions. Text filters can help detect unsafe content, but they cannot replace those controls.
This checklist assumes the agent reads untrusted input and can access private data or change external systems. Prompt injection is an instruction in that input that tries to redirect the agent. For example, a retrieved document may tell it to upload private files. Restricting tools and outbound requests limits what such an instruction can cause.
Controls by capability
| Capability | Control | What to enforce |
|---|---|---|
| Any tool use | Least privilege | Expose only necessary tools, as the OWASP MCP guidance recommends. |
| Private reads or external changes | Permission checks | Check the user, arguments, target, and allowed action immediately before execution. |
| Code, files, or browser automation | Sandbox | Limit accessible files, processes, browser state, and outbound destinations. |
| High-impact actions | Human approval | Show the exact target and change before a production deployment, payment, deletion, or external send. |
| Authenticated services | Scoped credentials | Restrict each integration to the necessary resources and actions. |
| Untrusted MCP servers | Server isolation | Review tool definitions and prevent one server’s returned instructions from granting access to another tool. |
| Tool execution | Audit traces | Record identity, target, permission decision, approval, and outcome; redact private payloads. |
| Input and output processing | Guardrails | Check coverage for each tool. A text filter does not grant permission or reverse a completed action. |
| Release and regression testing | Attack tests | Test prompt injection, misleading tool definitions, private-data disclosure, and permission bypasses. |
What to implement first
Remove unnecessary capabilities first. If the agent does not need to write to GitHub, do not give it a write token. If it only needs calendar availability, do not grant full mailbox access.
Next, check policy before every tool call. Inspect the tool name, arguments, target resource, user, environment, and side effect. A harmless-looking request can still produce a dangerous shell command.
Add sandboxes for code execution, browser automation, file access, and untrusted document processing. A sandbox does not make the action correct, but it reduces the damage from a compromised tool result or confused model.
Control data flow as well as execution. Restrict outbound network destinations, redact secrets from tool results, separate untrusted content from credentials, and log attempted egress. A filesystem sandbox that still permits arbitrary network access leaves a direct exfiltration path.
Use human approval for irreversible actions. Do not approve every step. Approve specific high-impact actions: production deploys, data deletion, email sends, money movement, permission changes, and regulated decisions.
MCP-specific risks
MCP is useful because it standardizes tool access. It is risky because tool descriptions, schemas, server identities, OAuth scopes, and tool outputs all become part of the model’s decision context.
For MCP, I would keep these rules in code review:
- review tool descriptions and schemas before approval
- prefer narrow per-server credentials
- isolate untrusted MCP servers from sensitive tools
- watch for tool definition changes after installation
- treat tool output as untrusted input
- log server and tool identities, policy decisions, and outcomes; minimize and redact arguments and results before saving them
Guardrails are not enough
Guardrails can check text and tool calls. In the OpenAI Agents SDK, input tool guardrails can block a guarded function tool before it runs. Hosted tools and built-in execution tools do not use that same pipeline, so check coverage for each tool you expose. Output checks happen after execution and cannot undo a side effect.
Enforce permissions before execution, alongside any guardrail checks. Keep credentials narrow and isolate tools even when their inputs pass validation.
Follow the OWASP logging guidance: exclude secrets and unnecessary personal data from traces. Restrict who can read logs and set a retention period. An audit trail should help reconstruct an action without copying every private payload.
Deeper reading
- AI Agent Security is the full architecture guide.
- AI Agent Tool Use explains MCP, tools, CLI, skills, and code execution.
- Long-Running AI Agent Runtime covers runtime boundaries for long-running agents.