In short
AI agent security is the protection of an individual AI agent across its lifecycle: how it is created, what identity and credentials it holds, which tools it may call, what it remembers, what it is allowed to do, and how it is monitored and shut down. Its goal is to keep an autonomous agent inside an authorized, observable and reversible envelope of action.
Definition
AI agent security is the set of controls applied to a single autonomous agent so that its actions stay authorized, attributable and reversible. Where agentic AI security describes the whole discipline, AI agent security is the per-agent implementation: identity, entitlements, tool scope, memory hygiene, runtime tracing and decommissioning.
An AI agent is not an application in the classical sense. It has no fixed control flow: given a goal, the model selects tools and sequences them at runtime. Security therefore shifts from reviewing code paths to bounding capability — deciding in advance which actions the agent may take, under which conditions, with which data, and who is accountable for it.
Because agents authenticate as non-human identities, agent security sits at the intersection of identity governance and application security. NIST's zero-trust guidance applies directly: authenticate every request, authorize per action, assume compromise and minimize implicit trust zones.
Security risks
Standing credentials
Agents often hold long-lived API keys or tokens so automation does not break. Those credentials outlive the task, the project and sometimes the team that created them.
Unbounded tool scope
An agent given a generic HTTP or shell tool effectively has unlimited capability, regardless of how narrow its stated purpose is.
Untrusted input treated as instruction
Retrieved documents, API responses and user messages all enter the same context window. Without trust separation, data becomes command.
Persistent memory drift
Agents that write to their own memory can accumulate manipulated or simply wrong facts that quietly steer future decisions.
No ownership or offboarding
When the creating team moves on, the agent keeps running with valid access and no accountable owner.
Untraceable actions
If only API calls are logged, an investigator can see what happened but never why the agent decided to do it.
Examples
Finance reconciliation agent
An agent granted write access to the ledger to fix mismatches. A crafted invoice line convinces it to approve a payment adjustment that no human reviewed.
DevOps triage agent
An incident agent with cluster admin restarts services during outages. An injected log line prompts it to scale down a production namespace.
Research agent with browsing
A market-research agent visits an attacker-controlled site that instructs it to fetch and post internal context to an external endpoint.
Inherited orphan agent
An agent built during a pilot keeps polling a data warehouse a year later; nobody remembers it exists until an audit finds the token.
Architecture
Agent identity
One credential per agent, short-lived, scoped to the data domain, mapped to a human owner and an expiry date.
Policy decision point
A runtime authority that evaluates every proposed tool call against policy before it executes, rather than trusting the model to self-restrict.
Tool broker
A mediated layer between the agent and real APIs that enforces allow-lists, validates parameters, redacts sensitive fields and rate-limits.
Memory store with write policy
Explicit rules on what may be written to long-term memory, with provenance on every entry and the ability to expire or quarantine.
Trace pipeline
Structured records of prompt, plan, tool call, arguments, result and policy decision, retained for investigation and replay.
Controls
Issue per-agent, short-lived credentials
Replace shared service accounts and static keys with workload identity that expires automatically and is revocable in one action.
Bind tools to purpose
Enumerate the exact operations the agent needs. Ban generic shell, generic HTTP and wildcard database access.
Enforce authorization outside the model
Never rely on the system prompt to prevent an action. Policy must be evaluated by code the model cannot influence.
Quarantine untrusted content
Tag retrieved content as data, strip instruction patterns, and prevent it from expanding scope or triggering privileged tools.
Require approval for irreversible actions
Payments, deletions, permission grants and external communications should need a human or a second control to proceed.
Assign an owner and an expiry
Every agent gets a named owner, a business justification and a review date, enforced by automation rather than a spreadsheet.
Comparison
| Aspect | Human user | Service account | AI agent |
|---|---|---|---|
| Decides next action | Yes, with judgment | No, fixed code | Yes, at runtime from a model |
| Susceptible to social engineering | Yes | No | Yes, via prompt injection |
| Scales | Slowly | Predictably | Instantly, in populations |
| Offboarding | HR-driven | Change-managed | Frequently absent |
| Explains its intent | Yes | N/A | Only if traces are captured |
Frequently asked questions
Is an AI agent just a non-human identity?
It has a non-human identity, but the identity is only one attribute. Unlike a static service account, an agent chooses its own actions, which is why intent-level controls and tracing matter.
Can I secure agents with API gateways alone?
A gateway is a good enforcement point for tool calls, but it does not know why the agent made the call, what content influenced it, or which Principal created the agent.
How many agents do enterprises run?
Most organizations cannot answer this, which is the point. Counts from copilots, developer tooling and SaaS automations typically exceed the documented inventory by a wide margin.
What is the single highest-value control?
Reducing standing privilege. Short-lived, narrowly scoped credentials cut the blast radius of every other failure mode.
Sources
How Andeavour addresses it
Per-agent identity governance
AgentGuard inventories agents, maps each to an owner and enforces least privilege on the credentials they use.
Action-level containment
High-impact tool calls are gated, traced and revocable, so a manipulated agent cannot convert access into irreversible damage.
Creation-layer coverage
Because AgentGuard also secures AI Principals, newly spawned agents inherit policy instead of appearing outside governance.
See it against your own environment
A 30-minute technical session with the Andeavour team — no integration required to start.