Agentic AI Security Evaluation Checklist

Are agents assigned ephemeral, scoped identities rather than persistent long-lived tokens?

Are tools restricted by granular ACLs (e.g., read-only Slack access, scoped file paths)?

Do high-impact actions (deleting data, moving funds) require explicit human approval via CLI/UI?

Are agent-spawned processes monitored at the kernel level for unauthorized activity?

Does the agent execute code in a transient, network-isolated container (Firecracker/gVisor)?

Can the security layer block a command (e.g., `rm -rf /`) in < 5ms before execution?

Does the system intercept outbound tokens to LLMs and redact PII/Secrets in real-time?

Are redactions contextual (e.g., redacting credit card numbers while keeping the structure)?

Is data transmission restricted to authorized API endpoints and VPC-locked providers?

Is there a non-repudiable log of every prompt, tool call, and response generated by the agent?

Does the system alert when an agent's command frequency or API usage deviates from baseline?

Can you trace a compromised secret back to the specific agent and prompt that leaked it?