AI Agent Security: What to Ask Before You Buy

1. What access does it actually need?

Good answer: a specific, scoped list, read-only wherever possible, with write access limited to named actions in named systems.

Bad answer: admin credentials to your whole workspace because it is simpler. Simpler for whom.

2. What does it do when it is not sure?

Good answer: stops, queues the item, notifies a person, and does nothing else.

Bad answer: anything describing what it decides. An agent with no uncertainty route will act confidently and wrongly.

3. Where does our data go, and is it used for training?

Ask which model provider, under which agreement, and whether your data is retained or used to train. Ask for it in writing. This is a normal request and a provider who resists it is telling you something.

4. What is logged?

Good answer: every action, with a timestamp, the input that triggered it, and a way to trace any output back to its cause. If you cannot audit it, you cannot trust it, and you certainly cannot debug it.

5. How do we turn it off?

There should be a single obvious kill switch that a non-technical person can operate at 2am without calling anyone. Ask to see it.

6. What happens at the end?

Who owns the agents, the prompts, the integrations and the logs when the relationship ends? Get the answer before you start, not during an exit.

The prompt injection question

An agent that reads untrusted input — inbound email, web pages, uploaded documents — can be manipulated by instructions hidden inside that content. This is a real and unsolved class of attack, not a theoretical one. The mitigations are architectural: scope permissions tightly, require approval for consequential actions, and never let content the agent reads determine what the agent is allowed to do.