NIST describes secure and resilient behaviour as a core characteristic of trustworthy AI. For agentic systems, that principle becomes concrete when a model can call tools, access business data or act in an external system.
1. Give the agent a bounded identity
Use a dedicated service identity rather than a shared human account. Limit scopes by task and environment, prefer short-lived credentials and make ownership visible. The agent should not inherit broad access merely because its operator has it.
2. Separate planning from permission
A model may propose an action, but a policy layer should decide whether the action is permitted. High-impact operations—payments, deletion, privilege changes, external publication—need deterministic checks and, where appropriate, human approval.
3. Treat retrieved content as untrusted
Emails, documents, webpages and tool outputs can contain instructions aimed at the model. Preserve the distinction between data and authority. Restrict what retrieved text can cause, validate tool arguments and avoid passing secrets into contexts that do not need them.
4. Log decisions at the action boundary
Capture who initiated the run, the agent version, requested tool, arguments, policy decision, result and downstream side effect. Avoid logging sensitive content by default; keep enough structured evidence to reconstruct the action.
5. Design a safe failure mode
Rate limits, transaction caps, timeouts, circuit breakers and idempotency reduce the cost of loops and ambiguous retries. A kill switch should revoke the agent's credentials and stop queued work, not depend on sending another prompt.
Keep a person accountable
“Human in the loop” is not a control unless the person sees the important context, has time to decide and can safely reject the action. Assign a named system owner and define which decisions can never be fully delegated.