AI Agent Security Review Checklist: 30 Controls Before You Let an Agent Act
This free AI agent security review checklist gives security architects, IT directors, and enterprise AI teams thirty concrete controls to verify before an agent is allowed to call tools or write to business systems. It is written for organizations running AI alongside ERP, MES, CRM, and field service platforms, including defense contractors handling export-controlled data. The controls are grouped into identity, tool permissions, prompt and input security, data handling, and monitoring. Eight items are marked critical because their absence converts a helpful assistant into an unlogged privileged actor. Work through the list, evidence each check, and remediate critical gaps before granting write access.
0 of 30 items complete
8 critical items still open - these are the highest-risk gaps.
Identity and access
Tool and action permissions
Prompt and input security
Data handling and residency
Monitoring, audit, and response
Check an item only if it is true in production today and you could show evidence to an auditor. The eight critical items are the controls whose absence turns a helpful agent into a privileged, unlogged actor inside your business systems; any unchecked critical item should be remediated before the agent is granted write access, regardless of your overall percentage. Above 85% with all critical items checked is a reasonable bar for an agent that can change data.
Get the full AI agent security review pack
We will email you a personalized expert breakdown of your unchecked controls with severity ratings and remediation guidance, and a Netray security specialist will follow up to review the findings with your team.
No spam. Your results stay private. Unsubscribe anytime.
Why agents need a different review than chatbots
A read-only chatbot leaks information at worst. An agent that can call tools takes actions, and those actions inherit whatever permissions you granted it. The security question shifts from what the model might say to what it might do, and to who can trick it into doing that. Traditional application security assumes code paths are fixed; an agent chooses its own path at runtime based partly on text it read from an email, a supplier PDF, or a web page. That is why this checklist spends as much attention on tool scoping and untrusted content as on credentials, and why human confirmation on high-impact actions remains the single most effective control.
The four failure patterns behind these controls
Every control on this list maps to one of four failure modes we see repeatedly in enterprise agent deployments, and none of them are exotic. Understanding which pattern a control defends against makes the individual checks far easier to prioritize when you cannot close everything at once, and it gives you language for explaining the risk to executives who have only seen the demo.
- Over-permissioned identity: the agent runs as an admin account because scoping was deferred, so any compromise is total.
- Indirect prompt injection: instructions hidden in retrieved documents or inbound email redirect the agent's actions.
- Permission bypass in retrieval: the vector store flattens source-system access controls and exposes documents to the wrong users.
- Invisible actions: tool calls are not logged with the initiating user, so nothing can be investigated after the fact.
How to use your score
Treat the critical items as pass or fail rather than as points. An agent with twenty-five of thirty items checked but no action logging is less defensible than one at twenty items with every critical control in place, because the first cannot be investigated when something goes wrong. Sequence remediation by blast radius: start with anything that lets the agent write, delete, or spend, then close identity scoping, then monitoring, then the hardening controls. Re-run the review whenever you add a tool, change the model, or expand the agent's data sources, because each of those changes the effective attack surface even when no code changed.
How Netray secures enterprise AI agents
Netray designs and deploys AI agents for manufacturers and defense contractors where the data cannot leave the building. We run models on-prem or air-gapped, scope agent identities against Infor SyteLine, Infor LN, M3, ServiceMax, and Salesforce entitlements, and instrument every tool call so security teams get an auditable record tied to a real user. Our reviews include red-team testing for indirect prompt injection using your own document corpus, not generic samples. If you are preparing for a CMMC assessment or an internal audit of an agent already in production, we can produce the control evidence package alongside the remediation work.
Frequently Asked Questions
What is indirect prompt injection and why is it the hardest control?
Indirect prompt injection happens when instructions are hidden inside content the agent reads rather than typed by the user: a supplier PDF, a web page, or an inbound email. The model cannot reliably distinguish data from instruction, so no prompt-level fix is complete. The durable defenses are architectural: scope tools tightly, require human confirmation for high-impact actions, isolate retrieved content from system instructions, and log everything so an injected action is at least detectable.
Can we just give the agent the same permissions as the user it serves?
That is the right target and it is harder than it sounds. Most retrieval layers copy documents into a vector store and lose the source system's access control lists, so a user can retrieve content they could never open directly. Enforce entitlements at query time by filtering on permissions carried alongside each chunk, and have downstream systems evaluate the end user's rights on every write rather than trusting the agent's own service identity.
How does this checklist apply to ITAR or CMMC environments?
It applies in full, plus boundary constraints. Export-controlled technical data must stay inside your approved enclave, which usually rules out commercial API models and pushes you toward on-prem or air-gapped deployment. Logging requirements are stricter, retention is defined by policy rather than convenience, and the agent's data sources need documented classification. The critical items in this list map closely to CMMC access control, audit, and system integrity practice families.
Book an AI agent security review with Netray and get an evidenced control assessment plus a prioritized remediation plan.
Related Tools
AI Governance Maturity Assessment
Score your AI governance across policy, inventory, risk classification, data handling, monitoring, and executive oversight, and get a banded improvement roadmap.
AI Agents & AutomationAI Pilot-to-Production Readiness Assessment
Score your AI pilot against the ten gates that decide whether it reaches production, and get a prioritized list of the gaps blocking deployment.
AI Agents & AutomationAI Center of Excellence Setup Checklist
A 32-point checklist for standing up an AI Center of Excellence that delivers working systems instead of slide decks, covering charter, funding, platform, governance, and adoption.
Go Deeper
Air-Gapped LLM Deployment Patterns That Actually Work
Air-gapped LLM deployment patterns that work: offline model transfer, update workflows, monitoring without telemetry, and CMMC-ready architectures.
On-Prem LLM Deployment Architecture: Reference Guide
Reference architecture for on-prem LLM deployment: inference servers, GPU sizing, RAG pipelines, and security zones for regulated manufacturers.