AI agents: Technical exposure and controls
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 7
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
Trace the exposure path
List each agent’s tools, identity, data access, spending scope and approval path. Include scheduled agents and connections that survive beyond the employee session that created them.
Build a small evidence map from the initiating dependency to the identities, business data and operations it can reach. Include indirect consumers and scheduled work. An inventory entry describes a possible path; activity logs and other account evidence are needed to establish what happened on that path.
Collect the right evidence
- Separate agent identities from broad employee or administrator credentials.
- Test direct API calls that attempt to bypass the conversational approval flow.
- Record asset identifiers, artifact or configuration versions, permission scope, evidence dates and the owner of each unresolved question. Do not include secret values.
Control and repair
Suspend the specific tool or permission implicated in unexpected behavior and preserve action metadata. Keep a human-controlled fallback for the business workflow.
Move consequential authorisation into application controls. Narrow identities, separate read and write tools, bound spending and require a business approver where the workflow warrants it.
Prove the boundary
Test denied actions and approval bypass attempts with safe synthetic data. Verify that revocation stops scheduled and in-flight actions, and that logs identify the approving human when required.
Use positive tests for the business function and negative tests for the access that should now be denied. Record which environment was tested and whether it represents production. Do not treat a successful login, clean homepage or healthy infrastructure graph as a substitute for an authorization or integrity test.
Engineering handoff
A set of negative tests proving the agent cannot cross tenant, spending or approval boundaries.
An agent register with tool scopes, approval owners, logs and revocation tests.
Acceptance gate
Allow production actions only within a documented scope that has passed denial, approval and recovery tests.