AI Agent Security: What Buyers Need to Ask

An AI agent is risky because it can act, not because it can chat.

Treat the sales demo as a map of what is possible, not evidence that the controls work. Ask the agency to put the answers below in the design, test plan, and handoff materials before the agent gets production access.

What can the agent reach?

Start with every system, data source, and tool available to the agent. OWASP's 2025 Top 10 for LLM Applications is the current LLM-application taxonomy, not the complete taxonomy for agentic applications. It includes Prompt Injection, Sensitive Information Disclosure, and Excessive Agency. The older OWASP Foundation page displays an archived v1.1 taxonomy. OWASP's separate Top 10 for Agentic Applications lists action-specific risks such as Agent Goal Hijack, Tool Misuse, and Identity & Privilege Abuse. For a buyer, use the LLM list to ask about model-facing inputs and data, and the agentic list to ask about tools, identities, memory, communication, and cascading actions. Neither list proves the system is secure.

Ask the agency to show:

Every inbox, database, file store, application, and API the agent can reach.
Which credentials it uses and whether those permissions are narrower than a human administrator's.
Where customer messages, uploaded files, retrieved documents, and web content enter the workflow.
How test and production data, credentials, and tool connections are kept separate.

The answer should distinguish read, write, delete, export, and administrator access. “It connects to the CRM” is not enough detail to approve.

What can it change?

Make the agency name the business action behind each tool call. Drafting an email is different from sending it. Preparing a refund is different from issuing one. Looking up an account is different from changing its price, permissions, or status.

Which records can the agent create, edit, delete, or send outside the company?
Can it move money, change access, accept terms, or communicate on the company's behalf?
What value, volume, recipient, rate, and time limits apply to each action?
What happens when an input requests data or an action the user is not allowed to receive?

Ask for enforced limits in the application and connected systems. A sentence in a system prompt is not the same thing as a permission boundary.

How is an action approved?

Approval should follow the consequence of the action. Decide which steps may run automatically, which need a named person, and which should not be available to the agent at all.

What context does the approver see before accepting or rejecting the action?
How does the system confirm the approver's identity and authority?
Can an old, duplicated, or edited request reuse an earlier approval?
Where do refusals, failed tool calls, and uncertain results go for human review?

Have the agency demonstrate approval and rejection paths with the real roles and permissions planned for launch. A slide that says “human in the loop” does not show where the loop is.

What gets logged?

NIST's generative AI profile recommends documented testing, monitoring, incident response, and risk management across the AI lifecycle. Ask what evidence your team will have when an output is disputed or an action goes wrong.

The request, user, model and prompt version, retrieved sources, and relevant policy checks.
Each proposed and completed tool call, including its parameters, result, time, and cost.
Approval, rejection, override, error, and escalation events with the responsible identity.
Retention, access, export, and redaction rules for logs that may contain sensitive data.

Then ask someone outside the build team to trace one test transaction from request to outcome. A large volume of logs is not useful if your operators cannot reconstruct what happened.

How do you stop it?

A shutdown plan should cover more than turning off the chat window. The agency needs to explain how your team disables tools, revokes credentials, contains queued work, and moves the process to a manual fallback.

Who can pause one workflow, one customer account, or the whole agent?
How quickly do revoked credentials and changed permissions take effect?
Which completed actions can be reversed, and which require a separate correction?
Who owns investigation, notification, recovery, and the decision to restart?
Can the business keep operating while the agent is unavailable?

No checklist proves that an agent is secure. These questions expose the control boundaries, evidence, and operating responsibilities you need to evaluate before granting access.

Bring these questions to the agency call.

Describe the systems, actions, and approvals involved. Your request may be sent to an agency or held for review.

Send a brief