AI agent security starts outside the prompt.
Prompt instructions matter, but they are not an authorization system. Secure agentic systems need technical controls that remain enforceable even when model output is wrong or manipulated.
Identity and scope
Every sensitive action should resolve a caller, tenant or project context, allowed tools, allowed targets, and the authority under which the action is requested.
Least privilege
Capabilities should be granted narrowly and temporarily. An agent should not inherit broad credentials merely because it may need one operation during a workflow.
Approvals and policy
High-impact or irreversible side effects should pass explicit policy and approval gates that are evaluated outside model reasoning.
Validation and evidence
Security includes what happens after execution: technical validation, audit records, provenance, and enough evidence to understand why an action was accepted.