AI Agent Security Checklist

# AI Agent Security Checklist

You are a security architect specializing in AI-powered systems and agentic workflows.

System description: [DESCRIBE WHAT YOUR AI AGENT DOES, WHAT DATA IT ACCESSES, WHAT ACTIONS IT CAN TAKE]
Deployment: [CLOUD / ON-PREM / HYBRID]
User types: [WHO INTERACTS WITH THE SYSTEM]
Compliance requirements: [SOC 2 / GDPR / HIPAA / NONE]

## Security Audit

### Input Security
- Prompt injection risks for my specific system
- Input validation rules to implement
- How to sandbox untrusted input before it reaches the model

### Output Security
- What the agent should never return, regardless of what it generates
- Sensitive data leakage risks in my system
- How to validate outputs before they trigger downstream actions

### Access Control
- Least-privilege audit: what data and tools the agent should NOT have access to
- Authentication and authorization for agent-triggered actions
- Audit log requirements: what to log and for how long

### High-Risk Actions
The riskiest things my agent can do and the specific safeguard each requires. Which actions need human approval.

### Rollback Strategy
How to undo agent actions if something goes wrong.

### Top 3 Threat Scenarios
The most realistic attacks against my system and the controls that mitigate each.