Agentic AI Secure Dev Checklist

The agent has a named business owner, technical owner, and security reviewer.

The use case is documented, including what the agent is allowed and not allowed to do.

The agent is classified by risk level: informational, internal workflow, sensitive-data access, or production action-taking.

High-impact actions are identified, including deletes, privilege changes, payments, external messages, customer-impacting changes, and production modifications.

The agent uses a dedicated identity, not a shared human account.

Permissions are least-privilege and scoped to the exact systems, records, repositories, or APIs required.

Credentials are short-lived where possible and stored in an approved secrets manager.

Privileged actions require step-up approval, human approval, or a separate controlled workflow.

Access is reviewed on a recurring schedule and removed when the agent is retired.

Approved data sources are listed, owner-approved, and separated from untrusted public content.

Sensitive data exposure is reviewed before content is indexed, embedded, retrieved, summarized, or sent to a model.

Retrieval results are permission-filtered so users cannot use the agent to access content they should not see.

Prompts, outputs, logs, and traces are reviewed for accidental storage of secrets, PII, credentials, regulated data, or confidential material.

Data retention, deletion, and export behavior is documented.

The agent treats webpages, documents, emails, tickets, chats, and tool outputs as untrusted input.

System instructions clearly tell the agent to ignore instructions found inside retrieved content or external data.

Tool calls are constrained by allowlists, parameter validation, and server-side authorization checks.

The agent cannot reveal hidden prompts, credentials, system instructions, private context, or other users' data.

Prompt-injection tests are performed using malicious documents, webpages, and tool responses before release.

Every connected tool has an owner, purpose, approved actions, and maximum impact documented.

Tool execution is logged with user, agent, timestamp, action, input parameters, and result.

Dangerous tools are separated from read-only tools and require stronger approval gates.

MCP servers and plugin-style connectors are treated as privileged integration points and reviewed before use.

The agent is blocked from chaining actions into unapproved workflows or escalating privileges through tool combinations.

Users can clearly tell when they are interacting with AI-generated output.

The agent explains uncertainty and does not present guesses as verified facts.

Human approval is required before irreversible, external, regulated, financial, legal, security-sensitive, or production-impacting actions.

Rate limits, spending limits, tool-use limits, and runaway-task protections are configured.

The agent has a kill switch or disable path that support/security teams know how to use.

The agent has been tested against misuse cases, unexpected inputs, jailbreak attempts, and prompt injection.

Security tests include unauthorized data access, unsafe tool execution, excessive autonomy, and identity abuse.

Regression tests exist for critical prompts, retrieval behavior, tool permissions, and safety controls.

Production release requires approval from the product/business owner, technical owner, and security reviewer.

A rollback plan exists if the agent behaves unexpectedly after release.

Logs capture prompts, tool calls, key decisions, approvals, errors, and blocked actions at an appropriate sensitivity level.

Alerts exist for unusual access, repeated tool failures, high-risk actions, policy bypass attempts, and anomalous volume.

Incident response playbooks include AI-specific scenarios such as prompt injection, data leakage, rogue automation, and connector compromise.

The team can reconstruct what the agent saw, decided, and did during a security review.

Model, prompt, connector, and data-source changes are change-controlled.