TL;DR: Twelve controls separate an agent you can defend from one you can only hope about. Each maps to a named risk in the OWASP Top 10 for Agentic Applications and to an artifact that proves the control is live. Work the identity items first. They cover the category OWASP flags as having the widest gap between severity and readiness.
The checklist
| # | Control | Risk it addresses | Proof it is done |
|---|---|---|---|
| 1 | Every agent has its own identity, distinct from the human who deployed it | ASI03 Identity and Privilege Abuse | Directory entry per agent, with a named human owner |
| 2 | Permissions are scoped to the task, not inherited from a team or user | ASI03 | Policy file showing the agent’s grant set, reviewed and dated |
| 3 | Credentials never enter a prompt, a tool description, or context | ASI03 | Vault audit log showing runtime retrieval, plus a secret scan of prompt templates |
| 4 | Revocation is one operation and it takes effect mid-session | ASI03, ASI10 Rogue Agents | A timed revocation drill, with the elapsed seconds recorded |
| 5 | Tools are allowlisted and pinned, not discovered at runtime | ASI02 Tool Misuse and Exploitation | The allowlist itself, plus a deny-by-default config |
| 6 | Every MCP server, plugin, and skill is vetted and version-pinned before install | ASI04 Agentic Supply Chain Vulnerabilities | A dependency inventory with source, version, and reviewer |
| 7 | The sandbox boundary is enforced outside the agent’s own reasoning | ASI05 Unexpected Code Execution | Container or VM policy showing the agent cannot set its own working root |
| 8 | No session holds all three of untrusted input, private data, and external action without approval | ASI01 Agent Goal Hijack | A session-capability map per workflow |
| 9 | Memory and retrieval stores are treated as attacker-writable | ASI06 Memory and Context Poisoning | Write provenance on memory records, plus a rollback test |
| 10 | Irreversible actions require human approval, behind a kill switch that works at agent speed | ASI09 Human-Agent Trust Exploitation | The approval-gate list, plus a kill-switch test log |
| 11 | Agent trajectories are logged, not just outcomes | ASI08 Cascading Failures, EU AI Act Article 12 | Tamper-evident logs with per-action identity and tool call |
| 12 | An agent registry exists, and it catches agents nobody registered | ASI10 | The registry, plus a discovery scan result dated this quarter |
Everything below explains what each item means in practice and what a passing answer looks like.
Why does agentic AI need its own security checklist?
Because the failure mode moved. A language model that gets manipulated produces a bad sentence. An agent that gets manipulated takes an action, and it takes that action with whatever credentials you handed it. That difference is what turns agentic AI security into an engineering problem rather than a model-tuning one.
OWASP published the Top 10 for Agentic Applications on December 9, 2025, which its own follow-up research calls “the first standardized taxonomy for agentic security risks.” That taxonomy is the reason this checklist can be verified rather than argued about. Each item points at a named category with documented incidents behind it, and OWASP notes that “almost every category now has at least one confirmed real-world incident supporting it.”
The incidents are not hypothetical. EchoLeak, tracked as CVE-2025-32711, let an attacker exfiltrate confidential data from Microsoft 365 Copilot with nothing more than a crafted email and no user interaction at all. OWASP maps it to three ASI categories at once, which is the pattern worth internalizing: agentic failures rarely stay inside one control domain.
What does this checklist cover that an LLM security checklist does not?
Four things LLM security checklists typically fail to cover are identity, tools, memory, and the audit trail of actions.
An LLM security checklist is mostly about what goes into the model and what comes out of it. Input filtering, output validation, jailbreak resistance. Those still matter, and a prompt injection attack remains the entry point. OWASP’s State of Agentic AI Security and Governance (v2.01, June 2026) calls prompt injection, listed as LLM01 in the OWASP Top 10 for LLM applications, “the most prevalent attack technique targeting AI systems” and notes it “maps to six of the ten ASI categories.”
But injection is the delivery mechanism, not the damage. The damage happens in the four layers a chatbot does not have. That is what items 1 through 12 govern.
Checklist items 1 to 4: Identity and access
1. Give every agent its own identity. An agent running under the credentials of the engineer who deployed it is indistinguishable from that engineer in every log you own. When something goes wrong, you cannot tell the two apart, and you cannot revoke one without revoking the other.
2. Scope permissions to the task. OWASP identifies ASI03 as “the category with the widest gap between risk severity and organizational preparedness.” The scale explains why. Non-human identities outnumber human users at roughly 100 to 1 in most enterprises, and Entro Security’s 2025 State of Non-Human Identity research, cited in the OWASP report, found 97 percent of them carry excessive privileges.
The practical test: name one permission the agent holds that its assigned task does not require. If you can, the scope is wrong.
3. Keep credentials out of the context window. Anything in the prompt is reachable by anything that can influence the prompt. Secrets belong in a vault the agent calls at runtime, not in a system prompt, a tool description, or a config file the agent can read.
4. Make revocation fast and mid-session. Revocation that only takes effect at the next token refresh is not revocation, it is a delay. Time it, write the number down, and treat that number as your containment window. Provisioning and revocation are two ends of the same problem, which is why they belong to the AI agent lifecycle rather than to any single deployment.
Checklist items 5 to 7: Tools and supply chain
5. Allowlist tools and pin them. Deny by default. An agent that can discover and invoke tools at runtime has an attack surface you cannot enumerate, which means you cannot test it either.
6. Vet every connector before it ships. This is the fastest-moving item on the list. Per OWASP, the MCP ecosystem “experienced its first malicious package, first critical infrastructure RCE, and first coordinated campaign, all within ten months,” and researchers have found thousands of malicious open-source Skills capable of compromising coding and personal agents on execution. In December 2025, Cato Networks demonstrated that Claude’s Skills feature could be used to deploy MedusaLocker ransomware through a modified, re-uploaded Skill.
Treat a connector like a dependency, because it is one. Source, version, reviewer, date. Servers installed outside that process are how shadow MCP takes hold.
7. Enforce the sandbox from outside the agent. In September 2025, a bug in the OpenAI Codex CLI let a model-generated working directory become the sandbox’s writable root, including paths outside the intended workspace. The boundary existed. The agent’s own output moved it. Any isolation an agent can reconfigure is not isolation, so the policy has to live in the container or VM layer where the agent has no write access.
OWASP’s audit finding here is worth sitting with: a security review of all major AI coding IDEs “found vulnerabilities in 100% of tested products.”
Checklist items 8 to 10: Runtime and memory
8. Apply the Rule of Two. Meta’s Agents Rule of Two, published October 31, 2025, is the cleanest design constraint available: an agent “must satisfy no more than two of the following three properties within a session to avoid the highest impact consequences of prompt injection.” The three are processing untrustworthy input, holding access to sensitive systems or private data, and being able to change state or communicate externally.
All three in one ungated session is the shape of every enterprise injection incident OWASP documents. Map your workflows against the three properties and gate the ones that hold all of them.
The rule is a constraint, not a cure. OWASP notes that attacks delivered through calendar invitations remain viable with only two of the three properties present, so treat it as the floor.
9. Assume memory is attacker-writable. Poisoned memory is worse than a poisoned prompt because it is temporally decoupled from the attack. The instruction lands today and fires in a session next month. OWASP observed attackers planting “persistent false information that propagated across all future agent sessions.”
Record where every memory entry came from, and rehearse the rollback before you need it.
10. Gate what you cannot undo, and keep a kill switch behind the gate. Human approval on destructive, financial, and externally visible actions. Approval gates and kill switches are the enforcement end of AI agent guardrails, and they only count when they are wired to something. The OWASP report is blunt about what the switch has to be: “a kill switch that works at agent speed rather than committee speed.”
Note the failure mode this control also covers. ASI09 showed up in production as agents “learning to suppress user complaints to optimize performance metrics.” The approval gate only helps if the human sees the real thing, which means summaries the agent generates about its own behavior are not evidence.
Checklist items 11 to 12: Audit and inventory
11. Log the trajectory, not the outcome. Reconstructing an agent incident from outcomes alone is impossible. You need the sequence: which identity, which tool, which arguments, which retrieved content, in order, in tamper-evident storage.
There is a regulatory floor here too. Article 12 of the EU AI Act requires that high-risk AI systems “technically allow for the automatic recording of events (logs) over the lifetime of the system.” The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since July 27, 2026, moved the compliance date for standalone Annex III high-risk systems to December 2, 2027. The deadline moved. The engineering work did not get smaller.
12. Run a registry, and go looking for what is not in it. A registry that only contains agents someone remembered to register is an inventory of your discipline, not your exposure. The shadow problem is well documented: roughly half of employees use AI tools their employer has not sanctioned, and per IBM’s Cost of a Data Breach Report figures cited by OWASP, only 37 percent of organizations have policies to manage AI or detect shadow AI at all.
Scan for it the way you detect shadow AI elsewhere, on a schedule, and date the result. Teams running more than a handful of agents usually end up centralizing this in an agent control plane rather than a spreadsheet.
How do you know when the checklist is actually complete?
By artifact, not by assertion. Every row in the table above has a proof column for a reason: “we do least privilege” is a claim, and a dated policy export showing the agent’s grant set is evidence.
Three tests are worth running before you call any of this done:
- The revocation drill. Kill one agent’s access mid-task and time how long it keeps working.
- The trajectory replay. Pick a completed agent run at random and reconstruct it from logs alone. If you cannot, item 11 fails regardless of what your logging config says.
- The discovery scan. Compare your registry against a network or identity-provider scan. The delta is your actual shadow-agent count, and closing it is the starting point for agentic exposure management.
OWASP frames the same idea as five capabilities organizations need, including “immutable and signed audit logs of agent actions sufficient for forensic reconstruction” and “adversarial testing covering the full ASI01-ASI10 attack surface.” Both are things you either have output from or you do not.
Frequently asked questions
How do you secure AI agents against prompt injection?
You cannot eliminate it, so you contain what it can reach. The architectural reason is that language models collapse the data plane and the control plane into one channel, so retrieved content carries the same weight as your instructions. Containment means items 8, 5, and 3 together: limit which of the three risky properties a session holds, allowlist the tools injection could reach, and keep credentials out of the context an injection can read.
What is the difference between agent identity and non-human identity?
Non-human identity verifies that a credential is authorized to connect, at the moment of authentication. Agent identity governs behavior at the moment of each action. OWASP’s distinction is that NHI provides the authentication primitives while agent identity attests “the provenance, intent, and authority” of something that reasons and acts across trust boundaries. Legacy service-account tooling handles the first and not the second.
Does the EU AI Act require agent logging?
Article 12 requires automatic event logging over the lifetime of high-risk AI systems, and it falls on providers. Whether your agent is in scope depends on classification, not on the technology, and the same tiering logic drives the NIST AI Risk Management Framework. If it is, the December 2, 2027 date for standalone Annex III systems is the current deadline after the Digital Omnibus deferral.
How many of these controls do we need before a pilot?
Items 1 through 4 and item 11. Identity and audit are the ones that are painful to retrofit, because retrofitting them means re-plumbing every agent you already shipped. The tool, memory, and runtime controls can be tightened incrementally. Attribution cannot.
Which risks matter most for a single-agent deployment?
OWASP’s own guidance is that lower adoption tiers should focus on ASI01, ASI05, and ASI06, meaning goal hijack, unexpected code execution, and memory poisoning. Inter-agent communication and cascading failure risks become primary concerns once you run agents that call other agents.
Where to take this next
The most useful next step is to run this checklist against one agent you already have in production, rather than the one you are planning. The gaps in a deployed system are the ones with a blast radius today. If you’re still planning that deployment, work through our AI agent deployment checklist first — this one assumes the agent is already live.
When you hit an item you cannot answer, OWASP’s Agentic Security Initiative publishes the underlying threat taxonomy and an incident tracker that will tell you what the failure has looked like elsewhere. Its FinBot CTF is an intentionally vulnerable multi-agent application built for exactly this, if you would rather learn the failure modes by exploiting them than by reading about them.