AI Agent Security: A Checklist Before Access

AI agent security comes down to one decision you make before the agent ever runs: what it is allowed to touch. Give it its own account, the narrowest read-only access that does the job, a human approval step before anything it does leaves the building, and a log you can read. Then widen access one workflow at a time, once it has earned it.

TL;DR: The Australian Signals Directorate and its Five Eyes counterparts say never to grant agents broad or unrestricted access, and to start with low-risk tasks. Prompt injection has no fully reliable fix, so the real controls sit around the agent: narrow scopes, its own account, human sign-off on irreversible actions, logs and a tested off switch.

The agents now arriving in business software can read a mailbox, open shared files, update a CRM and send email on your behalf. Staff pasting text into a chatbot is a different risk (see Shadow AI: The Business Risk You Can’t See), and whether the vendor trains on your data is a different question (our AI vendor data privacy checklist covers it). This is about the sanctioned agent you are about to switch on.

What the ACSC actually says about agents

The Careful adoption of agentic AI services guidance, published on cyber.gov.au on 1 May 2026, was co-authored by ASD’s ACSC with security agencies from the US, Canada, New Zealand and the UK. Its listed audience is large organisations, critical infrastructure and government, but the core advice suits a 30-person firm just as well: never grant agentic AI “broad or unrestricted access, especially to sensitive data or critical systems”, and use it only for low-risk and non-sensitive tasks.

The follow-up, Agentic AI harnesses (11 September 2026), makes the point SMBs most need to hear. You control the harness, the layer of connectors, permissions and approval gates around the model, not the model itself. Of its governance questions for executives, two carry most of the weight: what can the agent access, and which actions require human approval?

ASD’s blog When AI agents take unexpected actions describes an ABC News report from 10 August: an AI assistant asked to make a booking in an Australian gym’s system reserved classes beyond the permitted window and removed another customer from a waiting list, then could not undo it. Nobody hacked anything: the assistant bypassed the booking limits on its own.

Prompt injection, in plain English

An agent reads instructions and content through the same channel. If an email, web page, PDF or form submission contains text that looks like an instruction, the agent may follow it. That is prompt injection, and the ACSC’s harness guidance says plainly that “no fully reliable technical mitigation currently exists”. The fix has to come from limiting what the agent can access and do.

The clearest documented case was made public in April 2026. Researchers at Capsule Security found a flaw in Microsoft Copilot Studio, tracked as CVE-2026-21520 and rated 7.5 (high). According to VentureBeat’s report, a crafted payload typed into the comment field of a public SharePoint form was treated as an instruction. The agent queried connected SharePoint Lists for customer data and emailed it to an outside address through Outlook. Microsoft’s safety checks flagged the request and the data went out anyway, because sending email was an action the agent was authorised to take. Microsoft patched it on 15 January 2026. The same researchers showed a similar path through a public lead form in Salesforce Agentforce; Salesforce said it had fixed that scenario and that human confirmation is on by default for email actions, though Capsule disputed how far the fix went.

The ingredients were an agent that reads untrusted public input, can see customer records and can email outside the organisation. Take away any one and this attack has nowhere to go, which is where most of the checklist below comes from.

Read, write, send, pay: decide each one separately

Setup screens bundle permissions; pull them apart before you accept. Google’s Gmail API separates read-only access from send-only access, and only the broadest scope lets an app permanently delete mail and bypass the trash. A tool that wants that scope to summarise your inbox was not built carefully.

We would start every agent read-only on one workflow, with drafts as its only output, for a few weeks. Write access is earned once you have read its logs and trust what it does. One dependable agent live in a month beats five broad-access agents in a week and a quarter spent unwinding them.

The AI agent security checklist

Work through this before the agent touches anything real. Each row has an owner, because unowned controls rarely survive the first busy month.

The spend cap is a security control too. The ACSC harness guidance notes that watching consumption can reveal runaway agent loops and “denial-of-wallet” attacks, and Copilot Studio agents are billed in Copilot Credits per response or action. Our article on Copilot Credits pricing covers capping it.

If you would rather choose that first workflow with help, our AI Quick-Win Audit maps one or two high-friction workflows over ten business days, ranks the opportunities by estimated time and dollar impact, and includes a live working demonstration of one real opportunity in your own tools.

The Privacy Act angle

An agent that reads customer emails or CRM records is handling personal information. If the Privacy Act covers your business (most with turnover above $3 million, plus some smaller ones such as health service providers), it applies to what the agent sees and produces. The OAIC’s guidance on commercially available AI products says privacy obligations cover both personal information put into an AI system and output that contains it. APP 11 requires reasonable steps to protect personal information from misuse and unauthorised disclosure, and an over-scoped agent emailing customer data to a stranger is the disclosure it exists to prevent. If the breach is likely to cause serious harm, the Notifiable Data Breaches scheme requires you to notify the affected people and the OAIC.

From 10 December 2026, the OAIC says APP entities must explain in their privacy policy when they have arranged for a computer program to make or inform decisions that significantly affect individuals’ rights or interests. An agent that drafts a reply is unlikely to meet that bar. One that screens applications, declines refunds or ranks customers for collections may well do so. The National AI Centre’s Guidance for AI Adoption makes “maintain human control” one of its six essential practices, which includes knowing how to override the system and keeping an alternative pathway for critical functions if it is taken offline.

What we see go wrong

Across more than 15 years of delivery work with organisations such as NSW Government, Telstra and Woolworths, the pattern with new system access has been consistent: permissions granted to get something working in a hurry tend to stay. Agents make that worse when someone connects one with their own login and nobody reviews the scopes again. The ACSC guidance describes the same failure: broad access granted to reduce friction, with permissions evaluated only at initial deployment.

The other mistake is treating the vendor’s safety features as the control. Copilot Studio’s filter flagged that attack and the email still went. Vendor guardrails help, but your permissions decide how bad the bad day gets. A custom build or n8n workflow follows the same rules; our AI agent development work starts from them, and what AI agents actually do covers where they earn their keep.

Conclusion

Good AI agent security is mostly decided before the agent runs: its own account, the narrowest access, people approving anything that cannot be undone, logs you have actually read and an off switch you have tested. Start read-only on one workflow, watch it, and widen access only when the evidence supports it.

If you want help choosing that first workflow, book a free 30-minute fit call for the AI Quick-Win Audit. It is $2,950 flat, and the fee is credited in full toward any project of $10,000 or more commissioned within three months. Or get in touch to talk it through.

Frequently Asked Questions