AI agent security · an interactive guide
Contain the AI insider. Secure agents without slowing people down.
BusinessAI agents can now read your email, open your files and act inside your business apps. That makes them a new kind of insider. Securing AI means you can see every agent, limit what it can do, and react when it misbehaves, without locking out the person who uses it.
TechnicalTreat each agent as its own identity, grant task-scoped and time-bound permissions, evaluate risk continuously at the point of action, and enforce controls outside the model: on the endpoint, on the network, on the data path and in a sandboxed runtime.
Layered containment · select a layer
Controls you can use today
An agent can be contained at every layer it touches. Seven layers sit outside the AI model; guardrails inside the model help but are not enough alone. Select a layer for details.
Contain the agent, not the employee.
01 · Why it matters
AI agents are the new insider risk
Teams adopt AI agents faster than anyone can keep track of them. Agents run in the cloud and on laptops with real access to business data, and even an agent doing an approved job can go off course halfway through.
See every agent
You need to know which agents run, who owns them and what they can reach, in cloud apps and on local devices.
Limit what it can do
An agent should not inherit everything its user can access. It should get only what the task needs, only while the task runs.
Respond at machine speed
No team can manually review thousands of agent actions. Protection has to adjust as quickly as the agents act.
Never ask an AI model to police itself. Keep the rules about access, actions and when to stop outside the model, where the agent cannot argue its way past them.The core idea: the safest agent setup is the one that trusts the model the least.
With guardrails: the agent is a separate actor
The agent gets its own ID and only what its task needs. A risky agent is held back while the employee keeps working.
No checkpoint between the agent and your data
02 · The approach
Know, protect, adapt: around the clock
Securing agents is not a one-off project. It is a loop of three outcomes that keeps running, using the identity, device, data and network tools you probably already have. Select a step.
Steps advance on their own. Select one to pause on it.
03 · Discover and identify
Find every agent. Give each one an identity.
Identity is the foundation. Once an agent has its own identity, separate from the employee, you can give it permissions, review it, and remove it without touching the person it works for.
Discovery · device and network signals
Acts for a signed-in person
Works on behalf of one user but carries its own ID, so every action is recorded as the agent’s, not the person’s.
Local session identity
Command-line and desktop agents get a fresh identity for each session on the device.
Autonomous service identity
Runs on its own like a digital team member, with its own account and an accountable human owner.
Found, not yet managed
Spotted through device or network signals. Register it, give it an ID and an owner, or remove it.
The lifecycle of an agent identity
- Identity created · owner assigned
- Access requested
- Access approved for the task
- Access reviewed for least privilege
- Access expires automatically
- Identity retired when no longer needed
04 · Live agent risk
One risk level per agent, updated as it acts
Good agent security combines signals from your identity, device, data and network tools into a single risk level for each agent. Instead of a kill switch, the response then steps up gradually. Play the scenario to see how.
Signals → context → risk
Agent risk: 0
Scenario: the expense-checking agent
Graduated responses
Select Next signal to start the scenario.
Illustrative model for learning only. Real products weigh signals differently, and these numbers do not come from any specific vendor.
05 · Least privilege per task
Give agents just enough access, just in time
The employee keeps their normal access. The agent starts with none. Each task gets a narrow, time-limited permission based on what it needs and how risky it is, and that permission disappears when the task ends. Pick a task for the agent.
mail.read✓ standingmail.send✓ standingdata.read✓ standingdata.write✓ standingmail.readno accessmail.sendno accessdata.readno accessdata.writeno access| Aspect | Just-in-time permissions | Risk-based access checks |
|---|---|---|
| Question it answers | What access does this task need? | Given the risk right now, may this action go ahead? |
| When | Before and during the task: grant, re-check, remove | At the moment of each action, not only at sign-in |
| Typical tooling | Identity governance and privileged access tools | Conditional access policies extended to agents |
| Response | Narrow, time-limited grants | Graduated: allow, limit, ask a human, restrict, stop |
06 · Layers of defence for local agents
Contain agents on the device, network and data path
A local agent, such as a coding assistant running on a laptop, gets its own ID. Then every layer can act on the agent alone: device protection, a sandbox around the agent, a network filter and data loss rules. Send the agent a request.
These layers work independently, so if one is missing the others still help. No setup gives perfect isolation, and some actions can’t be traced to a specific agent yet, so combine layers rather than relying on one.
07 · Automation with people in charge
A team of guardian agents
Security tools increasingly use their own AI agents to watch over your AI agents. They work best as a team, following playbooks, with people setting the limits and approving big changes.
Not sure where you stand?Our free AI Agent Maturity Assessment scores your agent governance in about 10 minutes.
Take the assessment →Red team
Test: try to break your agents before attackers do.
Blue team
Watch: spot risky agent behaviour and triage it.
Green team
Fix: close the gaps that testing and monitoring find.
Set the policy, the approval limits and who may delegate what.
Describe the outcome and coordinate actions across your security tools.
Investigate, explain and act quickly, but only within those limits.
Security session · you are the IT lead
Example playbooks for illustration. Nothing here changes any real system.
08 · Roadmap
A practical 90-day plan
You don’t need every control on day one. Start with visibility and ownership, then tighten access, then add automatic responses.
- Weeks 1-2See
List every AI tool and agent in use, including browser extensions and desktop apps.
- Weeks 3-4Own
Give each agent an owner and its own identity. Turn on multi-factor sign-in everywhere.
- Month 2Limit
Remove standing access, grant per task, and add data rules for customer and payment details.
- Month 3Respond
Add risk-based checks, a few simple playbooks and a monthly access review.
| Capability | Common starting point | 90-day target |
|---|---|---|
| Inventory of agents | Missing | In place |
| Named owner per agent | Missing | In place |
| Separate agent identities | Partial | In place |
| Task-scoped permissions | Missing | Started |
| Data loss rules for AI | Missing | Started |
| Risk-based responses | Missing | Started |
The starting point is a common pattern for small teams, not survey data. Yours may differ.
Are you ready to let AI agents act for you?
Do you know which AI tools your team uses?
Does every agent have a named owner?
Is multi-factor sign-in on for every account?
Can agents reach customer or payment data?
Answer the four questions to see where you stand.
09 · An honest view
Pros, cons and watch-outs
Treating agents as separate, contained identities is a strong approach. It also takes effort, and the tooling is still young, so lay foundations now and expand as products mature.
10 · Check your understanding
Six-question quiz
A quick way to check the key ideas stuck before you talk to your team or IT provider.
6 to go.
11 · Next steps
What to do this quarter
Tick items off as you go. Your progress is saved in this browser only.
12 · Resources
Go deeper
Free tools on this site, plus trusted frameworks for securing AI.
This page explains general security concepts with illustrative simulations. It does not describe any single vendor’s product. Check controls against your own tools before relying on them.