Skip to content
best ai agent.inEvidence directory⌕ SearchExplore
Home / AI Agent Security Checklist — Pre-Deployment Review

Guide · in review

AI Agent Security Checklist — Pre-Deployment Review

Evidence-backed security checklist for AI agent deployments: permission scoping, tool validation, sandboxing, HITL placement, and audit logging. No agent should reach production without clearing every item.

This guide is evidence-ready but has not yet cleared editorial publication review, so it stays noindex until that review completes.

Direct answer (AEO)

No agent should reach production without clearing every item on this checklist. Each item is a security boundary; omitting one creates a blast radius that can range from data leakage to full system compromise.

Permission scoping

  • The agent can only call tools it has been explicitly granted.
  • Tool arguments are scrubbed of PII, secrets, and untrusted content before dispatch.
  • The agent cannot elevate privileges or escape its sandbox.
  • Permission boundaries are documented and reviewed before every deployment.

Tool validation

  • Inbound: every tool call payload is validated against its schema before dispatch.
  • Outbound: every tool result is validated against the expected return type and scanned for prompt-injection content before returning to the model.
  • Schemas are versioned; mismatched schemas are rejected, not silently dispatched.
  • No tool call is dispatched without both inbound and outbound validation.

Sandboxing

  • Agent‑generated code runs in a container or VM with restricted filesystem access.
  • Network access is limited to the tool endpoints the agent is permitted to call.
  • A kill switch or emergency stop is available and tested before deployment.
  • Sandbox resource limits (CPU, memory, timeout) are configured and monitored.

Human-in-the-loop checkpoints

  • Every consequential action (delete, payment, outbound email) has a pre‑execution HITL checkpoint.
  • High‑cost actions (refunds over a threshold, changes to user data) have a pre‑execution HITL checkpoint.
  • Post‑execution audit logs are maintained for all actions, with a correlation id linking the action to the workflow instance.
  • HITL is a workflow feature, not an agent feature — the orchestration runtime decides whether to dispatch or pause.

Audit logging

  • Every tool call, every result, every HITL decision is logged with a correlation id.
  • The audit log is immutable and retained for the period required by the applicable regulator (e.g. DPDP: minimum 1 year).
  • The audit log is accessible to the team and to auditors; it is not a hidden internal detail.
  • Prompt‑injection attempts, schema validation failures, and sandbox escapes are logged and escalated.

What we will not tell you

  • We will not tell you which checklist item is "the most important." Omitting any one item creates a non-trivial blast radius; all items are required.
  • We will not predict the probability of a security incident. Any number would be made up; we only surface measured audit-log outcomes.

Related pages

Frequently asked questions

Is HITL required for every action?

No. HITL is required for consequential actions (delete, payment, outbound email, changes to user data) and high‑cost actions (refunds over a threshold). Routine actions (a reply within a known FAQ, a code suggestion with confirm‑to‑apply) can be L1 Assisted without a pre‑execution checkpoint.

Can I skip sandboxing if the agent only calls read‑only APIs?

No. Sandboxing is not just about the data — it is about protecting the host system from unexpected behaviour in any tool call, even read‑only ones. A read‑only API that returns malformed data can still cause the agent to reason incorrectly; the sandbox is the engineering control that contains that failure.

What if my team cannot afford a full audit log?

Start with the minimum: log every tool call and result with a correlation id. Add HITL checkpoints for consequential actions first. Expand the audit log iteratively as operational capacity allows — but do not launch a production agent without at least the minimum log.

Source receipts

  • Internal — AI agent security best‑practices (this site, retrieved 2026-08-22). The checklist pattern is editorial and not drawn from a single primary source; it is a synthesis of common industry usage and the editorial board's review.
  • Internal — src/data/evidenceSchema.ts (retrieved 2026-08-22). The schema reference that backs every score on this site.

Last reviewed

  • Page last reviewed: 2026-08-22
  • Next scheduled review: 2027-02-22
  • Reviewer: BestAIAgent.in editorial board