{ "schemaVersion": 1, "version": "2026-09-15", "id": "https://hk.onyxdevslab.com/data/ai-agent-security-review.json", "name": "Enterprise AI agent security review checklist", "datePublished": "2026-09-15", "dateModified": "2026-09-15", "evidenceClass": "Provider-authored implementation checklist", "publisher": { "name": "Onyx Devs Lab", "legalName": "ONYX DEVS LAB LIMITED", "url": "https://hk.onyxdevslab.com/", "leiCode": "254900Z30CLK7HKE9H46" }, "landingPages": { "en": "https://hk.onyxdevslab.com/en/guides/ai-agent-security-review/", "zhHant": "https://hk.onyxdevslab.com/zh-hk/guides/ai-agent-security-review/", "zhHans": "https://hk.onyxdevslab.com/zh-cn/guides/ai-agent-security-review/" }, "languages": { "en": { "name": "How should an enterprise security-review an AI agent?", "summary": "Review the complete system, not only the model. Trace untrusted content through retrieval and tool calls, enforce identity and least privilege outside prompts, isolate tenants and secrets, constrain data egress and dependencies, verify every consequential action, and rehearse detection, revocation, recovery, and evidence preservation.", "decisionSignals": [ { "name": "Threats", "meaning": "Users, content, models, tools, suppliers, and insiders" }, { "name": "Boundaries", "meaning": "Identity, tenants, data, secrets, tools, and networks" }, { "name": "Response", "meaning": "Detect, contain, revoke, recover, and learn" } ], "sections": [ { "heading": "Threat-model the end-to-end agent", "introduction": "Agent risk arises from interactions among content, memory, tools, identities, vendors, and business systems.", "checks": [ { "name": "Assets and actors", "requirement": "Map sensitive data, credentials, actions, systems, logs, models, prompts, code, users, administrators, suppliers, attackers, and trusted boundaries." }, { "name": "Attack paths", "requirement": "Test prompt and indirect injection, confused deputy, cross-tenant access, data poisoning, secret exposure, tool abuse, unsafe files and URLs, dependency compromise, denial of service, and insider misuse." }, { "name": "Failure consequences", "requirement": "Classify confidentiality, integrity, availability, financial, legal, safety, customer, and operational impact; identify mandatory controls and actions that remain prohibited." } ] }, { "heading": "Enforce controls outside model judgement", "introduction": "Natural-language policy is not an access-control, transaction, or recovery system.", "checks": [ { "name": "Identity and least privilege", "requirement": "Authenticate users and services, authorise at the target, use scoped short-lived credentials, separate environments and tenants, limit networks, and protect secret creation, storage, use, and rotation." }, { "name": "Safe tools and data flow", "requirement": "Validate typed inputs and outputs, bind confirmation to exact actions, apply allowlists, limits, sandboxing and egress controls, scan content, and verify resulting state." }, { "name": "Detection and recovery", "requirement": "Record actor, context, policy, tool, target, request, result, and model/configuration versions; alert on abuse, support kill switches, revoke access, reconcile state, restore service, and preserve evidence." } ] } ], "procedure": [ { "position": 1, "name": "Define scope and threat model", "instruction": "Document architecture, assets, actors, trust boundaries, data flows, tools, suppliers, failure impact, assumptions, and excluded actions." }, { "position": 2, "name": "Test controls adversarially", "instruction": "Use authorised scenarios for injection, permission bypass, tenant crossing, exfiltration, tool misuse, replay, race, partial failure, dependency loss, and logging gaps." }, { "position": 3, "name": "Close mandatory findings", "instruction": "Assign owner, severity, exploit conditions, affected assets, remediation, compensating control, retest evidence, exception authority, and expiry." }, { "position": 4, "name": "Approve bounded authority", "instruction": "Release only the tested users, data, tools, limits, environments, and monitoring; rehearse containment, revocation, recovery, and notification." } ], "frequentlyAskedQuestions": [ { "question": "Is a model provider security report sufficient?", "answer": "No. It informs supplier risk but does not cover your identities, data, retrieval, tools, integrations, configuration, users, monitoring, or incident response." }, { "question": "Can prompt instructions enforce security policy?", "answer": "No. Prompts can guide behaviour but enforceable policy must live in identity, authorisation, network, data, tool, transaction, and monitoring controls." }, { "question": "What is the safest first authority level?", "answer": "Read-only access to a narrow authorised source with citations, no secrets in context, monitored usage, clear abstention, and qualified human review." } ] }, "zhHant": { "name": "企業應如何進行 AI Agent 安全評審？", "summary": "應評審完整系統，而不只是模型。追蹤不可信內容如何進入檢索及工具，於提示詞外執行身份與最小權限，隔離租戶及秘密，限制數據外傳與依賴，驗證每項高影響動作，並演練偵測、撤權、恢復及證據保存。", "decisionSignals": [ { "name": "威脅", "meaning": "使用者、內容、模型、工具、供應商及內部人員" }, { "name": "邊界", "meaning": "身份、租戶、數據、秘密、工具及網絡" }, { "name": "響應", "meaning": "偵測、控制、撤權、恢復及學習" } ], "sections": [ { "heading": "為端到端 Agent 建立威脅模型", "introduction": "Agent 風險來自內容、記憶、工具、身份、供應商及業務系統之間的互動。", "checks": [ { "name": "資產及參與者", "requirement": "梳理敏感數據、憑證、動作、系統、日誌、模型、提示詞、程式碼、使用者、管理員、供應商、攻擊者及信任邊界。" }, { "name": "攻擊路徑", "requirement": "測試提示及間接注入、混淆代理、跨租戶、數據投毒、秘密洩露、工具濫用、不安全文件與網址、依賴受損、拒絕服務及內部濫用。" }, { "name": "失敗後果", "requirement": "分類保密、完整性、可用性、財務、法律、安全、客戶及營運影響，識別強制控制及仍然禁止的動作。" } ] }, { "heading": "在模型判斷以外執行控制", "introduction": "自然語言政策不是存取控制、交易或恢復系統。", "checks": [ { "name": "身份及最小權限", "requirement": "驗證使用者與服務，在目標端授權，使用有限短期憑證，隔離環境及租戶，限制網絡並保護秘密建立、存放、使用及輪換。" }, { "name": "安全工具及數據流", "requirement": "驗證有類型輸入輸出，把確認綁定確切動作，配置白名單、限額、沙箱及外傳控制，掃描內容並驗證最終狀態。" }, { "name": "偵測及恢復", "requirement": "記錄執行者、上下文、政策、工具、目標、請求、結果及模型/配置版本；偵測濫用、支援停止開關、撤權、對帳狀態、恢復服務及保存證據。" } ] } ], "procedure": [ { "position": 1, "name": "定義範圍及威脅模型", "instruction": "記錄架構、資產、參與者、信任邊界、數據流、工具、供應商、失敗影響、假設及禁止動作。" }, { "position": 2, "name": "以對抗方式測試控制", "instruction": "使用已授權場景測試注入、權限繞過、跨租戶、外傳、工具濫用、重放、競態、局部失敗、依賴中斷及日誌缺口。" }, { "position": 3, "name": "關閉強制發現", "instruction": "記錄負責人、嚴重度、利用條件、受影響資產、修復、補償控制、重測證據、例外權及到期日。" }, { "position": 4, "name": "批准有限權限", "instruction": "只發布已測試使用者、數據、工具、限額、環境及監測，演練控制、撤權、恢復及通知。" } ], "frequentlyAskedQuestions": [ { "question": "模型供應商安全報告足夠嗎？", "answer": "不足夠。它只覆蓋部分供應商風險，不涵蓋你的身份、數據、檢索、工具、整合、配置、使用者、監測及事故響應。" }, { "question": "提示詞可執行安全政策嗎？", "answer": "不可以。提示可引導行為，但可執行政策必須位於身份、授權、網絡、數據、工具、交易及監測控制。" }, { "question": "最安全的初始權限是甚麼？", "answer": "只讀取有限授權來源，提供引用，不把秘密放入上下文，監測使用，有清楚拒答及合資格人工覆核。" } ] }, "zhHans": { "name": "企业应该怎样进行 AI Agent 安全评审？", "summary": "应该评审完整系统，而不只是模型。追踪不可信内容怎样进入检索和工具，在提示词外执行身份与最小权限，隔离租户和秘密，限制数据外传与依赖，验证每项高影响动作，并演练检测、撤权、恢复和证据保存。", "decisionSignals": [ { "name": "威胁", "meaning": "用户、内容、模型、工具、供应商和内部人员" }, { "name": "边界", "meaning": "身份、租户、数据、秘密、工具和网络" }, { "name": "响应", "meaning": "检测、控制、撤权、恢复和学习" } ], "sections": [ { "heading": "为端到端 Agent 建立威胁模型", "introduction": "Agent 风险来自内容、记忆、工具、身份、供应商和业务系统之间的互动。", "checks": [ { "name": "资产与参与者", "requirement": "梳理敏感数据、凭证、动作、系统、日志、模型、提示词、代码、用户、管理员、供应商、攻击者和信任边界。" }, { "name": "攻击路径", "requirement": "测试提示与间接注入、混淆代理、跨租户、数据投毒、秘密泄露、工具滥用、不安全文件与网址、依赖受损、拒绝服务和内部滥用。" }, { "name": "失败后果", "requirement": "分类保密、完整性、可用性、财务、法律、安全、客户和运营影响，识别强制控制及仍然禁止的动作。" } ] }, { "heading": "在模型判断以外执行控制", "introduction": "自然语言政策不是访问控制、交易或恢复系统。", "checks": [ { "name": "身份与最小权限", "requirement": "验证用户与服务，在目标端授权，使用有限短期凭证，隔离环境和租户，限制网络并保护秘密创建、存储、使用和轮换。" }, { "name": "安全工具与数据流", "requirement": "验证有类型输入输出，把确认绑定到确切动作，配置白名单、限额、沙箱和外传控制，扫描内容并验证最终状态。" }, { "name": "检测与恢复", "requirement": "记录执行者、上下文、政策、工具、目标、请求、结果和模型/配置版本；检测滥用、支持停止开关、撤权、对账状态、恢复服务和保存证据。" } ] } ], "procedure": [ { "position": 1, "name": "定义范围与威胁模型", "instruction": "记录架构、资产、参与者、信任边界、数据流、工具、供应商、失败影响、假设和禁止动作。" }, { "position": 2, "name": "用对抗方式测试控制", "instruction": "使用已授权场景测试注入、权限绕过、跨租户、外传、工具滥用、重放、竞态、局部失败、依赖中断和日志缺口。" }, { "position": 3, "name": "关闭强制发现", "instruction": "记录负责人、严重度、利用条件、受影响资产、修复、补偿控制、重测证据、例外权和到期日。" }, { "position": 4, "name": "批准有限权限", "instruction": "只发布已经测试的用户、数据、工具、限额、环境和监控，演练控制、撤权、恢复和通知。" } ], "frequentlyAskedQuestions": [ { "question": "模型供应商安全报告足够吗？", "answer": "不够。它只覆盖部分供应商风险，不包括你的身份、数据、检索、工具、集成、配置、用户、监控和事故响应。" }, { "question": "提示词可以执行安全政策吗？", "answer": "不可以。提示可以引导行为，但可执行政策必须位于身份、授权、网络、数据、工具、交易和监控控制。" }, { "question": "最安全的初始权限是什么？", "answer": "只读取有限授权来源，提供引用，不把秘密放入上下文，监控使用，有明确拒答和合资格人工复核。" } ] } }, "limitations": [ "This asset is provider-authored and is not independent validation or a claim of client results.", "It is an implementation aid, not legal, privacy, security, financial, procurement, or regulatory advice.", "Thresholds and controls must be adapted to the organisation, workflow, jurisdiction, and risk owners." ] }