AI Agent Security: A Field Manual

AI Agent Security: A Field Manual

1. Threats, Controls, and Verifiable Assurance for Autonomous Systems

Preface

1. Who this is for
2. How to read this book
3. A note on scope and honesty

The Agent Security Problem

1. What changes when a model can act
2. Why existing security models are necessary but not sufficient
3. The four attacker assumptions
4. The chain this book enforces
5. What “good” looks like

The Threat Taxonomy

1. Why a taxonomy, and how to use it
2. The ten threat classes
3. Reading the taxonomy as a system

The Control Taxonomy

1. From threats to a catalogue of moves
2. The four hardening surfaces
3. The sixteen control areas
4. Five principles that make the catalogue hold together

Identity and Authority

1. The question the log has to answer
2. Agent identity is distinct from human identity
3. Workload identity, short-lived and scoped
4. Delegated authority must be scoped, time-bound, and auditable
5. The delegate never holds scope greater than or equal to its parent
6. Correlation IDs across the delegation chain
7. What this buys you, and what comes next

Tool and Action Safety

1. Where a paragraph becomes a consequence
2. The tool registry and allowlist
3. Scope minimization and input validation
4. Sandboxing and execution isolation
5. Approval gates that check authority, not intent
6. MCP: the supply chain the agent trusts implicitly
7. EMA and the MCP Gateway pattern
8. An MCP and EMA configuration checklist

Untrusted Content, RAG, and Memory

1. The channel with no boundary
2. Provenance, trust metadata, and TTL
3. RAG poisoning: trusted by design, and that is the problem
4. Memory writes are privileged and reversible
5. Rollback as a first-class capability
6. Putting the three together

Monitoring, Evaluation, and Incident Response

1. What only exists once the agent is live
2. Logging that can reconstruct the episode
3. Monitoring and feed integration
4. Evaluation as standing regression
5. Rollback exercises
6. Incident response for agents
7. The abuse path: when the agent is the weapon

Runtime Security Posture

1. The gap between knowing and fixing
2. A dual-loop design
3. The posture state machine
4. Trigger classes and their SLAs
5. The kill switch and granular revocation
6. Policy version binding, the signal queue, and reconciliation

The Requirement Specification

1. Why controls have to become requirements
2. RFC 2119, used honestly
3. Scope
4. Identity and delegation (TH-05, TH-06)
5. Tool and action safety (TH-02, TH-07)
6. Untrusted content, RAG, and memory (TH-01, TH-03, TH-04)
7. Monitoring, evaluation, and incident response (general; TH-09, TH-10 abuse)
8. Runtime security posture (general)
9. Authority conservation and control-plane integrity (TH-02, TH-05, TH-06, TH-08, TH-09)
10. Governance and compliance (general)
11. How to read the tables as a whole

Verification and Testing

1. Turning SHALL into pass or fail
2. Four verification methods
3. Requirement-to-test mapping
4. Operational rules
5. Regression, not a gate
6. The companion kit and the signed artifact

Governance and Compliance

1. The accountability the technical controls assume
2. The governance record
3. Roles and responsibilities
4. Risk assessment and review records
5. High-risk determination and human oversight
6. Frontier-capability overlay determination
7. Governance as living artifacts

Authority Conservation for Long-Horizon Agents

1. Why least privilege is no longer sufficient by itself
2. Why this revision exists now
3. CT-16 — Control-plane integrity and authority conservation
4. The four forms of authority amplification
5. Normative requirements
6. Commit-time authorization: the async TOCTOU problem
7. Aggregate budgets: preserving authority across a graph
8. Persistent agents are delegations, not saved prompts
9. Credentials: reachable is not authorized
10. Compaction and persisted state: security metadata is not prose
11. Effect monitoring over intent monitoring
12. Verification additions
13. Frontier-capability overlay
14. What this chapter deliberately does not do
15. Source note for this revision
16. The design rule to carry forward

Acknowledgments

About the Companion Kit

Appendix A — Cross-Reference Tables

1. The master traceability table (TH -> CT -> REQ -> VT)
2. Requirement-to-threat index (REQ -> TH)
3. Control-to-chapter index (CT -> where it is treated)

Appendix B — Source Register

1. Normative primary sources
2. Vendor primary disclosures
3. Independent evidence and operational signals
4. A note on source independence
5. A note on coverage and gaps

Revision Note — 2026-09-04

1. Authority Conservation for Long-Horizon Agents
2. Editorial verification — 5 September 2026

Changelog & Errata

1. Revision history
2. Errata process
3. Resolved items
4. Known items carried forward