cyber.hendryadrian.com
Detection & Defense · jamf.com

How to Secure Agentic AI When Prevention Fails

· Original article ↗

Summary

The final installment of Jamf’s agentic-AI security series recommends separating trusted instructions from retrieved content, monitoring agent decisions, planning recovery, limiting delegated authority and matching controls to an agent’s capabilities.

Key points

  • Treat retrieved emails, webpages, documents, tool outputs and messages from other agents as untrusted data; preserve provenance and separate them from instructions.
  • Require policy checks or approval before retrieved content can trigger consequential actions, and enforce the initiating user's permissions during retrieval.
  • Log the agent’s decision and action path independently, including identities, sources, tool requests, authorization, approvals and outcomes; protect logs that may contain sensitive data.
  • Prepare for agent mistakes or compromise with revocable credentials, rollback, protected backups, tested restoration and incident playbooks.
  • Scale controls to an agent’s authority, from basic logging and rate limits for public-information assistants to isolation, scoped credentials and approval for cyber-capable agents.
  • Constrain every delegation hop: downstream agents should receive only task-specific authority that preserves or reduces the caller’s permitted scope.
  • Test deployed systems and recovery paths for prompt injection, unauthorized access, credential exposure, unsafe delegation and destructive actions.

Article Details

Defense Focus
Constrain agent authority and reduce the impact of manipulated or compromised agents through input provenance, independent monitoring, reversible actions, and recovery controls.
Detection Methods
  • Log and reconstruct the complete decision and action path, including the initiating user, agent identity, retrieved sources, selected tool, parameters, authorization decision, credential, destination, approval, and result.
  • Correlate user, agent, service-principal, delegated-identity, and credential-session activity.
  • Monitor tool use and network activity for unusual or unauthorized behavior, including unexpected destinations, blocked egress, unusual write volume, retries, spending, and delegation.
  • Test deployed systems for indirect prompt injection, poisoned documents, manipulated tool output, credential harvesting, confused-deputy scenarios, unauthorized delegation, and attempts to change approval settings.
  • Keep audit logs outside the agent's write path and protect prompt and context telemetry with access controls, encryption, redaction, minimization, and retention rules.
Data Sources
  • Prompts or protected summaries and context sources
  • Tool requests, names, versions, parameters, results, durations, and errors
  • Policy decisions, approvals, and outcomes
  • User, agent, service-principal, delegated-identity, and credential-session records
  • Network destinations, proxy decisions, DNS requests, and blocked-egress events
  • Write volume, resource access, retries, spending, and delegation events
Platforms
  • Microsoft Purview
  • Microsoft 365 Copilot
Defensive Actions
  • Preserve source, owner, location, and trust level for retrieved content; keep system policy, user requests, retrieved data, tool output, and peer-agent messages distinct.
  • Require external policy evaluation or approval before retrieved content can trigger consequential actions, and enforce the initiating user's permissions at retrieval time.
  • Use data-loss-prevention and sensitivity controls alongside source-system authorization; limit or isolate exposure to external content.
  • Revoke credentials individually, terminate sessions, and remove role bindings when an agent is compromised or misbehaves.
  • Use soft deletion, protected backups, versioning, rollback, and tested restoration procedures for systems agents can modify.
  • Ensure backups are isolated from identities and API paths that can delete primary systems; rebuild ephemeral execution environments when needed.
  • Scope and attenuate authority at every delegation hop; preserve initiating identity and task purpose, and treat cross-agent messages as untrusted or partially trusted input.
  • Match isolation, network controls, credentials, authorization, approvals, telemetry, and execution budgets to the agent's effective capabilities.
  • Review controls after material changes to models, tools, MCP servers, credentials, data sources, destinations, autonomy, or delegation paths.

Vendors

MicrosoftMicrosoft Purview provides examples of these controls around Microsoft 365 Copilot. For instance, its DLP controls for Microsoft 365 Copilot can restrict how sensitive prompts, files and emails are processed under

Products

Microsoft 365 CopilotMicrosoft Purview provides examples of these controls around Microsoft 365 Copilot. For instance, its DLP controls for Microsoft 365 Copilot can restrict how sensitive prompts, files and emails are processed underMicrosoft PurviewMicrosoft Purview provides examples of these controls around Microsoft 365 Copilot. For instance, its DLP controls for Microsoft 365 Copilot can restrict how sensitive prompts, files and emails are processed under

Related Articles