Agent Security Controls: Isolation, Credentials and Verification

An agent's permissions need enforcement outside the component proposing its actions. That is a reason to inspect the system boundary carefully, not evidence that model behavior no longer matters.

Correction, 22 October 2026: The earlier version claimed an industry-wide security standard, guaranteed that prompt injection could yield nothing useful and treated policy-controlled approvals as mandatory for every action. It also attributed protection properties to hardware more broadly than the cited designs establish. Those conclusions are withdrawn.

Mantis: reproduction requires containment and expert review

Google's Mantis repository describes a modular vulnerability-research toolkit with an ADK reference harness. It warns that findings and patches can be wrong and requires security-expert verification. A reproducer's success does not establish exploitability in every context; failure to reproduce does not definitively clear a finding.

The repository also labels the project a demonstration and says its pull-request action has not been run end to end against a live project. It should not be described as a proven production merge gate.

A proposed pipeline should retain the original hypothesis, the reproducer, environment details, observed outcome and expert assessment. Those artifacts serve different purposes. A model's confidence number cannot replace them.

Muse: credential isolation is one part of the boundary

Meta's architecture account describes a runtime cell separated from host-side safety, connector and credential services. Sentinel governs connector actions and network egress. Requests can be allowed, denied or referred to the user under policy.

Credential surrogation keeps real tokens outside the main agent: the authorized network request receives the real credential at the boundary. The same account describes separate models and classifiers inspecting inference traffic, so this design combines behavioral and infrastructure controls.

Keeping a token out of the prompt addresses direct token exposure. It does not prove that all authenticated actions are safe. An agent may still propose an unwanted change through an allowed interface. Review destination, method, resource, data and scope rather than treating possession of a surrogate as authorization for arbitrary activity.

The account describes the launch design. AI Mastery has not independently tested its implementation or established immunity to prompt injection.

Bedrock: check the chosen model and API path

AWS's Astra model card distinguishes features by endpoint and API. For example, its Guardrails support on bedrock-runtime is marked for Converse only. Do not assume that a feature listed for one path automatically applies to another.

AWS's abuse-detection documentation separately describes automated monitoring and retention. For its specified OpenAI models, classifier-flagged traffic can be retained for up to 30 days; eligible customers may request full zero data retention.

A private endpoint, an abuse classifier and a retention agreement answer different questions. Establish each relevant property for the actual account and route before describing the deployment's data boundary.

Review a concrete action

Consider an agent asked to summarize an invoice. Reading that document, extracting totals and writing a summary need one set of permissions. Paying it or changing the supplier's bank details needs another. A valid credential does not erase that distinction.

Record the permitted action, resource and identity at the tool boundary. For sensitive actions, confirm that approval is tied to the operation that will actually execute. Test denial, expired authorization and a destination changed after approval.

This is our proposed review procedure, not a certification of any vendor. Our shared-resource incident review explains why permitted internal services also belong in that assessment.