Start with the data flow
Map the user, agent runtime, model, retrieval sources, tools and downstream systems. Label every trust boundary before choosing a security control.
Five control areas
- Identity: Decide whether an action represents a user, a workload or delegated authority.
- Authorization: Check permissions at the tool and resource boundary, not only in the prompt.
- Input handling: Treat retrieved documents, tool outputs and web content as untrusted.
- Secrets: Never put long-lived credentials in prompts or model-visible context.
- Monitoring: Log tool requests, decisions, denials and high-risk outcomes without storing unnecessary sensitive data.
Practical test cases
Test a prompt-injection attempt in a retrieved document, an out-of-scope tool call, an expired delegated token and a malicious or changed MCP tool description. Record expected behavior and observed results.
Release criteria
No agent should launch before someone has reviewed its permitted actions, identities, failure modes, rollback plan, and escalation paths.
Takeaway
A checklist creates repeatable reviews, but enforcement belongs in tested runtime and backend controls rather than in natural-language instructions alone.
These tutorials are starter editorial examples; test commands and update all claims before public release.