Guidance Details Security Controls for Agentic AI Harnesses
Summary
The guidance explains how agentic AI harnesses connect LLMs to organizational data and tools, creating security and operational risks. It recommends least privilege, human approval, monitoring, logging and phased deployment to manage those risks.
Key points
- The harness connects an LLM to data, tools, memory and workflows, and controls which actions the agent can perform.
- Prompt injection cannot be reliably addressed within the model alone; the guidance recommends limiting access and permitted actions through the harness and surrounding systems.
- Organizations should use hardened environments and least-privilege permissions, restricting access to production systems, sensitive data and network services.
- Require human approval for sensitive or high-impact actions, and review and test agent outputs before operational use.
- Record and monitor prompts, responses, tool invocations, approvals, actions, security events and configuration changes to support audits and incident response.
- Adopt agentic AI in phases, starting with low-risk use cases and expanding as controls mature.
Article Details
- Defense Focus
- Secure and govern the agentic AI harness by limiting access and actions, applying human oversight, and monitoring activity across the harness and its integrations.
- Detection Methods
- Continuously monitor and independently review harness activity logs to support security monitoring, investigations, and incident response.
- Monitor API, token, or computing-resource consumption for unexpected activity that may indicate misuse, compromise, runaway agent loops, or denial-of-wallet activity.
- Review agent outputs and actions before operational use, and investigate unexpected behavior by examining both model decisions and harness configuration.
- Data Sources
- Prompts and model responses
- Tool invocations and actions
- Human approvals
- Security events
- Harness configuration changes
- API, token, or computing-resource consumption
- Defensive Actions
- Use an organisation-controlled, hardened environment containing only the tools and permissions required for the task; restrict access to production systems, sensitive data, and network services.
- Apply least-privilege access and strong identity and access management; control which tools, external data sources, and connectors are available.
- Validate tool parameters and outputs, prohibit unsafe actions, and require human approval for sensitive or high-impact actions.
- Protect, retain, review, and independently monitor logs of prompts, responses, tool invocations, approvals, actions, security events, and configuration changes.
- Keep model context focused on information needed for the task; remove stale content and limit retained information.
- Introduce agentic capabilities through phased deployment, starting with low-risk use cases and validating security controls before broader adoption.
- Integrate harness controls with established security practices, monitoring, and incident response processes.