AI Agent Security: A Field Manual

AI Agent Security: A Field Manual

1. Threats, Controls, and Verifiable Assurance for Autonomous Systems

Preface

1. Who this is for
2. How to read this book
3. A note on scope and honesty

The Agent Security Problem

1. What changes when a model can act
2. Why existing security models are necessary but not sufficient
3. The four attacker assumptions
4. The chain this book enforces
5. What “good” looks like

The Threat Taxonomy

1. Why a taxonomy, and how to use it
2. The ten threat classes
3. Reading the taxonomy as a system

The Control Taxonomy

1. From threats to a catalogue of moves
2. The four hardening surfaces
3. The fifteen control areas
4. Four principles that make the catalogue hold together

Identity and Authority

1. The question the log has to answer
2. Agent identity is distinct from human identity
3. Workload identity, short-lived and scoped
4. Delegated authority must be scoped, time-bound, and auditable
5. The delegate never holds scope greater than or equal to its parent
6. Correlation IDs across the delegation chain
7. What this buys you, and what comes next

Tool and Action Safety

1. Where a paragraph becomes a consequence
2. The tool registry and allowlist
3. Scope minimization and input validation
4. Sandboxing and execution isolation
5. Approval gates that check authority, not intent
6. MCP: the supply chain the agent trusts implicitly
7. EMA and the MCP Gateway pattern
8. An MCP and EMA configuration checklist

Untrusted Content, RAG, and Memory

1. The channel with no boundary
2. Provenance, trust metadata, and TTL
3. RAG poisoning: trusted by design, and that is the problem
4. Memory writes are privileged and reversible
5. Rollback as a first-class capability
6. Putting the three together

Monitoring, Evaluation, and Incident Response

1. What only exists once the agent is live
2. Logging that can reconstruct the episode
3. Monitoring and feed integration
4. Evaluation as standing regression
5. Rollback exercises
6. Incident response for agents
7. The abuse path: when the agent is the weapon

Runtime Security Posture

1. The gap between knowing and fixing
2. A dual-loop design
3. The posture state machine
4. Trigger classes and their SLAs
5. The kill switch and granular revocation
6. Policy version binding, the signal queue, and reconciliation

The Requirement Specification

1. Why controls have to become requirements
2. RFC 2119, used honestly
3. Scope
4. Identity and delegation (TH-05, TH-06)
5. Tool and action safety (TH-02, TH-07)
6. Untrusted content, RAG, and memory (TH-01, TH-03, TH-04)
7. Monitoring, evaluation, and incident response (general; TH-09, TH-10 abuse)
8. Runtime security posture (general)
9. Governance and compliance (general)
10. How to read the tables as a whole

Verification and Testing

1. Turning SHALL into pass or fail
2. Four verification methods
3. Requirement-to-test mapping
4. Operational rules
5. Regression, not a gate
6. The companion kit and the signed artifact

Governance and Compliance

1. The accountability the technical controls assume
2. The governance record
3. Roles and responsibilities
4. Risk assessment and review records
5. High-risk determination and human oversight
6. Governance as living artifacts

About the Companion Kit

Appendix A — Cross-Reference Tables

1. The master traceability table (TH → CT → REQ → VT)
2. Requirement-to-threat index (REQ → TH)
3. Control-to-chapter index (CT → where it is treated)

Appendix B — Source Register

1. Primary sources
2. Secondary signals
3. A note on coverage and gaps

Changelog & Errata

1. Revision history
2. Errata process
3. Known items carried forward