Agent security is broader than model security
An enterprise agent can read email, open files, create records and call other systems. Security cannot therefore be reduced to whether the model’s prose is accurate.
OWASP’s GenAI work groups risks such as prompt injection, sensitive-information disclosure, excessive agency and insecure output handling. A single system prompt is not an adequate control layer.
Seven baseline controls
Apply controls at the architecture level and retain test evidence.
- Least privilege for records and actions
- Separate read and write permissions; approve critical actions
- Treat untrusted content as data, not instruction
- Allowlist tools, recipients, domains and file types
- Value, repetition and time limits with automatic stops
- Tamper-resistant event logs and accountable alerts
- Rollback, access revocation and manual-continuity plan
Why shadow mode matters
The system first shows what it would do and why without taking the action. Compare recommendations with real user decisions, then analyse false positives, false negatives and ambiguous cases separately.
Do not enable write access until critical tests pass. A security failure is not offset by an attractive financial result.