AI Agent Security Checklist: Environment Readiness
A self-assessment, not an audit or a benchmark. It does not connect to any of your systems. The 1 to 3 weights are PlayCISO’s own judgement.
1. Verified execution isolation
Where the agent runs, and proof that the boundary holds, not a claim that it does.
Every agent run executes in a sandbox (container, microVM or managed cloud workspace) that is not an employee laptop or a shared build host.
The isolation has been tested from the inside: someone asked the agent environment to reach host files, other tenants and the control plane, and the attempts failed.
The agent sees only the files, repos and data its task needs. Home directories, SSH and cloud config folders, and other projects are not mounted.
Environments are short-lived and rebuilt from a known image, so anything an agent plants does not survive to the next task.
CPU, memory, time and spend limits are enforced outside the agent, so a runaway loop stops by itself.
2. Brokered credentials and distinct identities
The agent acts, but it never holds the keys, and every agent is a separate identity.
The agent environment holds no long-lived service credentials. Access comes from short-lived tokens issued by a broker or federated identity.
Calls to downstream systems go through a broker or gateway that attaches credentials outside the agent. The agent cannot read them even with full shell access.
Each agent (or each agent type per environment) has its own identity, separate from the human who started it and from other agents.
Tokens expire in minutes or hours, are bound to one task or environment, and cannot be refreshed after the task ends.
There is a tested way to revoke one agent identity and every token it minted without disturbing other agents.
3. Step-up authorization
Higher-risk actions need a fresh human or policy decision, outside the agent.
Actions are tiered (read, reversible write, irreversible or external effect) and anything above a stated tier needs approval.
Approvals arrive on a channel the agent cannot write to or click through, and they show the exact action, target and parameters.
Permissions start at the minimum and are raised on demand for a single operation, with each elevation logged.
Approval volume is monitored, and the policy is tuned so reviewers are not clicking through dozens of prompts a day.
4. Task-scoped permissions
Rights follow the task, not the agent product or the person who launched it.
Permissions are issued per task and expire with it. No agent holds standing broad rights "in case it needs them".
No wildcard or omnibus scopes (admin, full access, star) are granted to agents.
An agent cannot change its own permissions, policies, tool list or approval settings, directly or by editing a config it reads.
Each agent has an allow-list of tools and connectors with an owner, reviewed on a schedule, and unlisted tools are unavailable.
When one agent delegates to another, the sub-agent receives equal or narrower rights, never more, and delegation depth is limited.
5. Network and data-flow restrictions
Where the agent can send data, and what it can reach on the way.
Outbound traffic is deny-by-default and allowed per destination, enforced outside the agent (egress proxy or network policy).
Direct-to-IP connections, alternate DNS resolvers and encrypted DNS are blocked, so a DNS allow-list cannot be sidestepped.
The cloud metadata service is unreachable from the agent environment, or at least locked to its newest session-based version with a hop limit.
Private, loopback and link-local ranges are blocked for agent-initiated fetches, including after redirects.
Sensitive data classes are mapped to the agents allowed to see them, and data leaving through tool calls or model providers is logged.
6. A separate production boundary
Agents work in a place where mistakes are cheap, and reach production only through a gate.
Agent environments sit in separate accounts, projects or networks from production, with no standing route into it.
Changes reach production only through the normal pipeline or change process, with human review, never directly from an agent session.
Agents work on synthetic or masked data by default. Production data access is a separate, logged grant.
Where agents must read production, they use read-only roles with row, table or time limits.
Agent changes are blocked during change freezes and incidents unless a named person lifts the block.
7. Controlled software supply chain
What the agent can install, load or connect to is decided in advance.
Packages, images and plugins used by agents come from an internal mirror or approved list, with versions pinned.
MCP servers and agent tools are reviewed and registered before use. One-click installs that run commands are blocked.
The agent runtime image and its tool dependencies have an inventory (SBOM or AIBOM) that is kept current.
Models, prompts and rules files that shape agent behaviour are version-controlled and changed only through review.
8. Independent audit and containment
Records the agent cannot edit, and a stop button that really stops everything downstream.
Every tool call, approval and permission change is logged to a store the agent has no write or delete access to.
You can reconstruct the complete path of one agent task across every tool, sub-agent and downstream system.
A kill switch exists that stops running tasks, blocks new ones and is usable by security staff without the agent team.
The kill switch also revokes tokens, sessions and delegations the agent already handed out, and you have checked that downstream systems stop accepting them.
Detections exist for agent-specific behaviour (new tools, unusual destinations, repeated denied actions) and someone owns the alerts.
Your top gaps
Mark controls Partial or Missing and the highest-weighted gaps appear here, with the reason each matters.
Answers stay in this browser (local storage). Nothing is sent to PlayCISO.
TL;DRAt a glance
4 points
- 38 controls across eight areas. Mark each In place, Partial, Missing or N/A for a 0 to 100 score, a score per area and your top gaps.
- Every control lists the evidence to ask for. Where a primary source supports it, it is linked; where it is our own reasoning, it is labelled PlayCISO practice.
- The 1 to 3 weights are PlayCISO’s own judgement, not from a standard or survey.
- Runs in your browser; answers stay in local storage. Markdown and PDF export of the report.
How to use it
Pick one agent deployment, not the whole company. Answer from what you can show, not what you intend. Open “Why” on any control to see the reasoning and the evidence to request, then export the report for the owner of each gap. Re-run it after you fix the top three.
Managed cloud environments are one way to meet several of these controls, and vendors that sell them publish their own frameworks. Those are vendor views: judge any product by the evidence column and by tests you run yourself under authorisation, not by its marketing.
Frequently asked questions
What does this scorecard measure?
Whether the place your AI agents run is built so that a wrong, manipulated or compromised agent cannot do much damage. It scores 38 controls in eight areas: execution isolation, credentials and identities, step-up authorization, task-scoped permissions, network and data flows, a separate production boundary, software supply chain, and independent audit and containment.
How is it different from the Agent Governance Plane and the Harness Audit Lab?
The Agent Governance Plane is a reference architecture you click through for identity, guardrails and observability. The Harness Audit Lab trains you to audit a self-improving agent harness. This scorecard is a plain self-assessment of the environment around any agent, with evidence to request for each control, so you can use it on your own setup or a vendor’s.
How is the score calculated, and are the weights standard?
In place counts full weight, Partial half, Missing zero, and N/A is left out. Each control has a weight of 1 to 3. Those weights are PlayCISO’s own judgement, not taken from any standard or survey. Bands are Weak (below 30), Basic (30 to 59), Defined (60 to 84) and Strong (85 and above).
Is a high score proof that my agents are safe?
No. It records what you say is in place. Use the evidence prompts to check, and run the Vendor Boundary Test Kit to confirm the boundaries actually hold.
Can I use it to assess a vendor’s managed agent product?
Yes. Answer from the vendor’s documentation and what they show you, and ask for the evidence listed with each control. Vendors, including those who sell managed environments, describe their own products, so verify claims with tests in an authorised trial.
Are my answers sent anywhere?
No. They stay in this browser’s local storage. Markdown and PDF exports are built in your browser.
Sources
Pages below were fetched on 4 November 2026. We restate them in our own words.
- OWASP Top 10 for LLM Applications 2025 (includes LLM06 Excessive Agency, LLM03 Supply Chain) — OWASP Gen AI Security Project, 2025. Accessed 4 November 2026.
- Agentic AI: Threats and Mitigations (v1.0) — OWASP Gen AI Security Project, Agentic Security Initiative, 17 February 2025. Accessed 4 November 2026.
- AI Risk Management Framework — NIST, AI RMF 1.0 released 26 January 2023. Accessed 4 November 2026.
- Zero Trust Architecture (SP 800-207) — NIST, August 2020. Accessed 4 November 2026.
- Security Best Practices (Model Context Protocol) — Model Context Protocol project, as served 4 November 2026. Accessed 4 November 2026.Covers confused deputy, token passthrough, SSRF, session hijacking, local server compromise and scope minimization.
- Use the Instance Metadata Service to access instance metadata — Amazon Web Services, as served 4 November 2026. Accessed 4 November 2026.
- Workload Identity Federation — Google Cloud, as served 4 November 2026. Accessed 4 November 2026.
We tried to read Replit’s “Agent Habitat Architecture” post on 4 November 2026 and the page returned an error, so nothing here relies on it. Replit sells a managed agent product; treat any vendor framework as a vendor’s view, not a standard.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.