Agents
Agent tool permissions, audit records, and human oversight for production workloads.
An agent combines a model, tools, and an execution loop. Tool permissions determine which systems it can change and which data it can disclose. They also bound its spend.
Document agent access
Maintain a short record of each agent's access:
- List each tool and the specific operations it permits, such as reading named tables.
- Record the identity the agent uses and its permissions across connected systems.
- Include all data the agent can read through those tools.
- List the network destinations the agent can reach.
- Set the amount the agent can spend before a technical control stops it.
This record may show that credentials permit more than the agent's task requires. Narrow the credentials to the documented operations.
Handle untrusted content
Conventional applications separate code instructions from user data. A model may interpret content it reads as instructions, so an agent needs controls at the tool boundary.
Treat every retrieved document or message as a potential instruction to the agent.
Zero-click exfiltration from an assistant that could read everything
EchoLeak (CVE-2025-32711, CVSS 9.3) let an attacker exfiltrate internal data from Microsoft 365 Copilot by sending an email. No click, no attachment opened, no user action of any kind.
The skipped letter. Secure. The blast radius of an assistant is the union of everything it can read. Untrusted input reached a component holding broad standing access to internal documents, and the trust boundary between the two was assumed rather than enforced.
arXiv: EchoLeak, the first real-world zero-click prompt injection exploit / Hack The Box: inside CVE-2025-32711
Separate broad read access from broad write access. When one component requires both, route writes through a broker that validates them independently of the model's reasoning.
Enforce limits in tool permissions. Prompt instructions can reduce risk, while tool permissions determine which actions the agent can complete.
Restrict network egress to required destinations so the agent cannot send data to an arbitrary host.
Audit records
The trace is the raw material. The audit trail is what you can hand someone: for a given action, who or what did it, on whose behalf, when, with what authorization, and what changed.
Make the record tamper-evident so the agent cannot edit its own history. Index it by subject so a reviewer can retrieve actions involving a customer's record across sessions.
Logs support an audit when reviewers can answer those questions without writing a custom script.
Human oversight
Define the type of human oversight required for each action:
- Require approval before a limited set of high-risk actions.
- Review a sample after execution to identify recurring problems.
- Give an operator a way to interrupt a running agent and release its credentials. This depends on runtime support.
Use approvals selectively so reviewers can give them attention. Sampled review provides a separate check on actions that do not require prior approval.
Questions to ask your vendor, or your own team
- For your most autonomous agent, list its tools, identity, data reach, egress, and cost ceiling. Can anyone produce that today?
- What untrusted content does that agent read, and what stops instructions inside it from being followed?
- Can the agent reach an arbitrary host on the internet?
- For an action it took last week, can you produce who, on whose behalf, when, and under what authorization?
- Can a human stop a running agent, and does it release its credentials when stopped?
- Who reviews a sample of agent actions after the fact, and how often?