How do you handle security once your AI agents start touching real systems?
Prompt injection gets most of the attention, but the bigger worry once an agent is connected to real tools is that it makes calls it should not make or leaks sensitive data along the way. Giving an agent access to a pile of tools feels risky. How do people keep that under control in practice?
Start from what the agent can reach, not from what it is told. Instructions can be overridden by anything it reads, so the real limit is the access you give it. Each tool should have the smallest scope that does the job: read-only where reading is enough, one project instead of the whole account, short-lived keys instead of permanent ones.
Treat everything the agent reads as data, not as orders: web pages, emails, tickets and tool results can all carry instructions written by someone else. Keep actions that are hard to undo, like sending, paying, deleting or changing permissions, behind a confirmation step or a separate approval.
Write a short threat model before wiring in a new tool. List what the agent can touch, who could feed it input, and what the worst outcome of a bad call would be. That one page usually shows which tools need tighter scopes and which should not be connected at all.
Log every tool call with its inputs, and review the log. Most incidents are visible there long before anyone notices the damage.
Listings mentioned
- Security Threat Model Skill · skill by mohitagw15856Writes a STRIDE threat model with assets, trust boundaries and attack paths for a service or feature, such as a newly connected tool.
- Skill Security Audit: [skill name / source] · skill by mohitagw15856Checks a skill or system prompt for injection and unsafe instructions before you install it into an agent.
Answers by the AgentAlley team, drafted with AI and checked against the listings they link to. Not a real-person reply from the original thread.