How to secure AI agents: A checklist for prompt injection, permissions, and data privacy
Once an AI agent can read databases, send emails, or call external APIs, the risks are no longer limited to the accuracy of its answers. Security design must cover inputs, permissions, execution, outputs, and logs, rather than adding another layer of content filtering just before launch.
Map the agent’s attack surface first
Risks do not come only from user input. Web pages, emails, knowledge base documents, and responses from third-party tools may all contain embedded manipulative instructions; logs and error messages may also leak credentials. Before launch, map the complete flow of data ingestion, model processing, tool calls, result output, and log retention.
- Inputs: Public forms, web pages, emails, and uploaded files.
- Permissions: Databases, files, APIs, message sending, and deletion operations.
- Outputs: User responses, external writes, and data passed between agents.
- Dependencies: Community skills, third-party APIs, and runtime environments.
Keyword filtering alone cannot prevent prompt injection
System instructions and external content should be clearly separated into layers. Text from web pages or documents must be treated only as data and should not automatically receive permission to perform operations. Even if the model makes an incorrect judgment, runtime permissions must still prevent unauthorized actions. Add deterministic rules and human confirmation for actions such as deletion, export, payment, and sending data externally.
Use least privilege to limit the impact of incidents
| Resource | Recommended controls |
|---|---|
| Database | Prioritize read-only accounts and restrict accessible tables and the scope of returned data |
| Separate read and send permissions | |
| Files | Restrict accessible directories and block access to credentials by default |
| External APIs | Use separate credentials, rate limits, and allowlists |
| High-risk actions | Require human approval and record the person who executed the action |
Give each agent a separate identity to make revocation, rotation, and auditing easier. Do not grant write permissions in advance simply because they “might be needed later.”
Design privacy and logging together
Data minimization means collecting only the fields required to complete a task. Logs should be redacted by default and must not record passwords, tokens, or complete personal information; access controls and retention periods should also be established. When multiple agents collaborate, downstream agents should receive only the data required to complete their subtasks, rather than the entire conversation.
Pre-launch security checklist
- All untrusted external inputs have been identified.
- Tool permissions correspond directly to task objectives.
- Sensitive write operations require human confirmation and have idempotency safeguards.
- The sources, versions, and network access scopes of third-party skills can be verified.
- Rules for log redaction, retention, and deletion have been established.
- A tool call can be reconstructed from its trace without exposing credentials.
Frequently asked questions
Can prompt injection be completely eliminated?
It cannot be completely eliminated by relying solely on the model layer. Input isolation, least privilege, policy-based blocking, and human approval must therefore work together to reduce the risk.
Do small teams also need a comprehensive governance framework?
You can start with four measures: separate identities, read-only permissions, confirmation for sensitive operations, and redacted logs. Add more controls as business risks increase.
Does compliance simply mean obtaining a particular certification?
No. Compliance also depends on the specific data, use case, region, and organizational processes. This article provides an engineering checklist framework and is not a substitute for legal advice.
What to do next
Before configuring a real workflow in SmaugBrain, use read-only data and low-risk actions to conduct threat modeling and unauthorized-access testing, then gradually expand permissions.