AI Agent Security Checklist for Production Deployments

LLM-powered agents fail differently from traditional software: instead of a stack trace, you get a plausible-sounding wrong action. This checklist covers the controls we treat as non-negotiable before an agent touches production data or takes autonomous actions on a client's behalf.

1. Access and permissions

• Scope the agent's credentials to the minimum it needs — never reuse an admin key "for convenience."
• Separate read actions from write/destructive actions; require explicit tool grants per capability, not blanket API access.
• Rotate and expire any keys or tokens the agent holds, same as you would for a service account.

2. Human approval for consequential actions

• Anything irreversible — sending money, deleting records, emailing a customer, publishing content — goes through a human-in-the-loop confirmation step by default.
• Log the proposed action and the human decision together, not just the final outcome.
• Define explicitly which actions are pre-approved for full autonomy and keep that list short.

3. Data handling and privacy

• Know exactly what data is sent to the model provider, and whether it's used for their own training (most enterprise APIs let you disable this — verify it, don't assume it).
• Redact or tokenize PII before it reaches a prompt wherever the task doesn't genuinely require it.
• Apply the same data retention and deletion policy to conversation logs as you do to the rest of your data.

4. Prompt and output integrity

• Treat any content the agent reads (web pages, emails, documents, tool output) as untrusted input, not instructions — validate before acting on embedded directives.
• Constrain tool outputs with schemas/types where possible so a malformed or manipulated response can't silently propagate.
• Rate-limit and sandbox any code execution or shell access the agent has.

5. Auditability

• Log every tool call, input, and output the agent makes — you need this to debug failures and to demonstrate compliance.
• Version your prompts and system instructions like code, with change history.
• Run periodic reviews of agent transcripts, not just error-rate dashboards — silent wrong-but-confident actions won't show up as errors.

6. Guardrails and governance

• Define a clear rollback plan for when the agent is disabled or misbehaves — this should not require a code deploy.
• Assign explicit ownership: someone specific is accountable for the agent's behavior in production, not "the AI team" generically.
• Re-test guardrails after every model or prompt version change — behavior can shift even on "minor" updates.

Limitations of this checklist

This is a starting checklist based on patterns we apply in our own AI automation work, not a compliance certification or a substitute for a formal security audit. Regulated industries (healthcare, finance) will have additional legal requirements beyond what's listed here — involve your compliance team before shipping an agent that touches regulated data.