The 9 security review questions that keep agents out of production

The agent works. It has worked in staging for a month. The demo went well, the people who will use it want it, and it has been sitting in security review for six weeks while the same questions come back in slightly different words.

I spent last week reading what the reviewers are reading: the OWASP Top 10 for Agentic Applications (December 2025), the OWASP MCP Top 10, which is still in beta, NIST’s AI Risk Management Framework, a concept paper from NIST’s National Cybersecurity Center of Excellence on agent identity, and the joint “Careful adoption of agentic AI services” guidance that six agencies, including Australia’s ASD, published in May.

They converge. When NIST’s NCCoE wrote down its open questions about agents, four of its five technical sections were identification, authentication, authorisation, and auditing. The fifth was prompt injection. Your reviewer is asking variations of a short list, and most of it comes down to who the agent is, what it can touch, who said yes, and where the proof is.

Security is not the only reason agent projects stall. In Dynatrace’s 2026 survey of 919 leaders, security, privacy and compliance topped the list of barriers at 52 per cent, one point ahead of technical challenges. It is the one you can do something about this week.

Here are the nine questions I would prepare for. The weak and strong answers are my reading of the frameworks. No published rubric grades them.

Identity and delegation

1. Which agent is this? The weak answer is “it uses the integration’s service account” or “it runs as the engineer who set it up”. The strong answer is that each agent is its own principal with its own credential, on an inventory with a named owner. The Five Eyes guidance says to build “each agent as a distinct principal”. Bring the inventory entry and a log line from the target system that shows the agent’s own identity.

This is where many teams are today. In a Cloud Security Alliance survey commissioned by Aembit (228 respondents, January 2026), 43 per cent ran agents on shared service accounts and 31 per cent let agents act under a human’s identity.

2. On whose behalf, and can you trace it back? “Everything is logged” is weak if everything is logged under one account. The strong answer is that every action carries the agent and the person it acted for, and the delegated access is narrower than that person’s own. A security team at a regulated utility put it bluntly in a GitHub issue this year: it “requires every Bedrock invocation to be attributable to an individual”. Bring one real action traced end to end, from the request to the record in the target system.

Scope and credentials

3. What exactly can it touch? “The same access as the user” is the answer reviewers hear most and like least. The strong answer is a written list of the endpoints and actions this agent needs, enforced outside the model, and checked on every call. The Five Eyes guidance names the trap: if entitlements are “evaluated only once at system startup rather than at each invocation”, a stale allow decision can be exploited later. Bring the grant as configuration, and a denied call in the logs that proves the boundary holds.

4. Where do its credentials live, and for how long? An API key in an environment variable, or a long-lived personal token, will stall you. The strong answer is short-lived, scoped credentials, with the long-lived secret kept somewhere the model and the agent process never see. OWASP’s agentic list recommends “per-agent identities and short-lived credentials”. AWS’s own bulletin on the Amazon Q extension in July 2025 described how an “improperly scoped GitHub token” let an attacker inject code into a release. Bring credential lifetimes and your last rotation record.

Approval and containment

5. Which actions need a human yes? “The agent asks when it thinks something is risky” fails. The guidance is explicit that decisions about when approval is required should be “determined by system designers or operators, not delegated to the agentic AI system”. The strong answer is a list of approval-required actions in configuration, an approver who sees the real parameters (amount, recipient, record) instead of the agent’s summary of them, and a record of every approval. If approvals will arrive fifty times a day, say how you will stop people rubber-stamping them. Least agency is the principle behind this one.

6. What happens when it reads something hostile? A system prompt telling the model to ignore instructions in data is a weak answer. Assume an injection will sometimes succeed and show what limits the damage. The interesting thing about this question is that the best answer is questions 3 and 5 again. A hijacked agent with narrow scope and an approval gate on destructive actions does very little. Bring a test run with a planted instruction and the blocked or held action it produced.

7. Which tools and MCP servers can it load? “Developers add what they need” is the weak answer. The strong one is an allow list of tools, servers and versions with an owner who approves additions. Bring the list and the change record for the last thing added.

Evidence and the off switch

8. Show me what it did last Tuesday. “It’s in the application logs” is weak when the agent’s host can write to those logs and they don’t name the user. The strong answer is a record per action, kept out of the agent’s reach, with the agent, the person, the tool, the parameters, the decision and the result. OWASP asks for “immutable and signed audit logs”. In a CSA survey sponsored by Strata, 84 per cent of respondents doubted they could pass an audit of agent behaviour or access controls. Bring one agent’s export for one week.

9. How fast can you stop just this one? “We’d rotate the key” usually means stopping every agent and integration that shares it. The strong answer is per-agent revocation that takes effect on the next call, a named person who can trigger it, and a written decommissioning step. Bring a timed drill.

An instruction is not a control

The clearest case I found for why reviewers ask all this is Replit in July 2025. During a “code freeze” that existed only as an instruction to the model, its agent deleted a user’s production database, then reported that rollback would not work. It did. Replit’s chief executive called it “Unacceptable and should never be possible”, and the fixes the company announced were structural: separate development and production databases, and a planning-only mode. That incident fails questions 3, 5, 8 and 9 in one go.

Notice how often the strong answers repeat themselves. A separate identity per agent, access checked per call, approval set by people, a record the agent can’t edit. Seven of the nine questions are identity, scope, approval and evidence. The other two, injection and supply chain, are answered best with the same controls. If you are new to the split between who an agent is and what it may do, authentication versus authorisation for agents is the background.

This week, without buying anything: pick one agent, write a one-page answer sheet for all nine questions, and attach the artefact for each. Where you can’t attach one, you have found the work.

That one-page sheet is also roughly what I built AgentValet to produce. Each agent gets its own identity and only the endpoints it has been granted. Risky actions wait for a person. Every call is recorded with the agent, the user and the decision. The security page shows how each of those is built, if you want to compare it with your own answers.

Sources

• OWASP Top 10 for Agentic Applications 2026: genai.owasp.org
• OWASP MCP Top 10 (beta): owasp.org
• NIST NCCoE, Accelerating the Adoption of Software and AI Agent Identity and Authorization (concept paper, February 2026): nccoe.nist.gov
• CISA, NSA, ASD’s ACSC and others, Careful adoption of agentic AI services (1 May 2026): cyber.gov.au
• NIST AI Risk Management Framework 1.0, core: airc.nist.gov
• Dynatrace, The Pulse of Agentic AI 2026 (Y2 Analytics, n=919): dynatrace.com
• Cloud Security Alliance survey commissioned by Aembit (n=228, January 2026): cloudsecurityalliance.org
• Cloud Security Alliance survey sponsored by Strata (n=285): cloudsecurityalliance.org
• AWS Security Bulletin AWS-2025-015, Amazon Q Developer for VS Code: aws.amazon.com
• The Register on the Replit incident, 21 July 2025: theregister.com; Fortune, 23 July 2025: fortune.com
• GitHub issue on per-user attribution for Bedrock calls: github.com