Agentic workloads change the security calculus for production AI systems. When a model can autonomously invoke tools, iterate over multi-step plans, and maintain long-running context sessions, the attack surface expands beyond prompt injection to include privilege escalation through tool misuse, data exfiltration via external APIs, and supply-chain risks embedded in model weights. Securing these systems requires shifting from static input filtering to dynamic, architecture-level controls that govern trust boundaries between the model, its tools, and your data.
Map Your Threat Model Before You Armor
Start with threat modeling specific to agents. Unlike standard chat completions, agents consume tool outputs that are inherently untrusted. Your attack surface now includes indirect prompt injection delivered through a search result or API response, excessive privilege if the agent inherits broad-scoped credentials, and resource exhaustion from unbounded reasoning loops. Document every tool as a separate trust boundary, and classify each by blast radius: read-only public data, read-only private data, and mutating operations. Mutating tools should require human-in-the-loop gating or secondary authorization, never direct agent access.
Enforce Least Privilege for Tool Scopes
An agent should only receive tools it strictly needs for its current task. If an agent performs customer lookup, it does not need write access to your billing database. Validate tool schemas server-side, and reject arguments that exceed the intended scope. The following pattern enforces read-only, allowlisted table access before any SQL tool executes:
<code
