Agent Engineering8 min readUpdated October 28, 2026

AI Agent Security: Giving Hands Without Giving the Keys

An agent with your admin credentials is an unmonitored insider threat. Scope, gate, log, and cap.

Agents inherit the user's permission scope plus hard limits on top: cost caps per run, denied tool lists, approval gates on irreversible writes, and an audit log you actually read.

You are adding an automated actor to your system that reads and writes through tool calls. The threat model is a buggy or manipulated insider, not a Hollywood villain. Standard lessons from service accounts apply directly: least privilege, short-lived credentials, deny-by-default. The manipulation vector is new, the infrastructure answers are not.

See How We Work

In This Guide

The threat model is not exotic

You are adding an automated actor to your system that reads and writes through tool calls. The threat model is a buggy or manipulated insider, not a Hollywood villain. Standard lessons from service accounts apply directly: least privilege, short-lived credentials, deny-by-default. The manipulation vector is new, the infrastructure answers are not.
You are adding an automated actor to your system that reads and writes through tool calls. The threat model is a buggy or manipulated insider, not a Hollywood villain. Standard lessons from service accounts apply directly: least privilege, short-lived credentials, deny-by-default. The manipulation vector is new, the infrastructure answers are not.

Scoped permissions in practice

Three boundaries per tool call. Which tools exist at all. Which parameters are allowed on that tool. Which records the identity can touch. I build the tool definitions so permissions are structural: queries are filtered at the service layer, never by the prompt. A prompt cannot grant what the tool layer does not expose.
Three boundaries per tool call. Which tools exist at all. Which parameters are allowed on that tool. Which records the identity can touch. I build the tool definitions so permissions are structural: queries are filtered at the service layer, never by the prompt. A prompt cannot grant what the tool layer does not expose. That is the only reliable pattern.

Approval gates that users actually use

One approval fatigue failure and users auto-approve everything. Keep gates narrow: irreversible and external only. Show the exact diff and a one-click approve. Once a pattern repeats without edits for two weeks, let the user promote it to a standing rule with an audit trail. Trust is a progression, not a toggle.
One approval fatigue failure and users auto-approve everything. Keep gates narrow: irreversible and external only. Show the exact diff and a one-click approve. Once a pattern repeats without edits for two weeks, let the user promote it to a standing rule with an audit trail. Trust is a progression, not a toggle.

Audit and replay

The audit log is for you as much as for compliance. When something looks wrong, you need to re-walk the run: task, tool calls, identity, outputs. Store it in your normal logging infrastructure with a retention window that matches your compliance surface. An agent without a replayable log is an experiment with your data.
The audit log is for you as much as for compliance. When something looks wrong, you need to re-walk the run: task, tool calls, identity, outputs. Store it in your normal logging infrastructure with a retention window that matches your compliance surface. An agent without a replayable log is an experiment with your data.

5 Tips to Get Started

1

Act as the user, never as a service account with admin. The agent inherits that user's permissions, not more.

2

Approval gate every irreversible action: sends, deletes, payments, external API calls. Replayable actions run freely.

3

Log every tool call with inputs and the resolved identity. If you cannot replay an agent session, you cannot debug a production incident.

4

Cap cost per run. A tool loop that retries forever is a bill, not a bug, and it waits for the night.

5

Keep secrets in a vault with narrow grants. The agent should never see a raw long-lived credential.

Ready to Stop Worrying About Infra?

Knowledge is the first step. Get a free 1-hour diagnostic and see where your infrastructure leaks time, money, and focus.

Sources & References

roqy.io cites authoritative sources including engineering blogs, vendor documentation, industry surveys, and academic research to ensure accuracy.

Related Guides

Chatbot vs AI Agent: The Difference That Decides If Your Users Come Back

A chatbot answers. An agent acts. See the architectural difference, what it costs to build each, and which one keeps users on your SaaS.

AI Agent Development Cost in 2026: Full Build Budget Breakdown

What it actually costs to build and run a production AI agent: build fees, model spend, eval infrastructure, and monthly maintenance. Real numbers.

How to Add an AI Agent to Your SaaS Product (2-Week Production Plan)

A 2-week plan to add a production AI agent to your SaaS: pick one workflow, wire tools to your API, add permissions and eval, ship. No rewrite.

A2A Protocol Explained: What Agent2Agent Means for Your Product

The Agent2Agent (A2A) protocol in plain terms: agents as JSON-RPC services, agent discovery cards, streaming. What matters for SaaS builders in 2026.

R

Ron Cohen — DevOps engineer & founder, roqy.io

Content reviewed by the roqy.io team. Our guides are based on publicly available data and cited sources above.

Disclaimer: This content is for informational and educational purposes only. It does not constitute professional advice or a guarantee of specific results. Infrastructure needs vary by team, stack, and stage. Consult a qualified engineer for advice tailored to your situation.

Frequently Asked Questions

Should the agent have its own credentials?

Per-run, short-lived, derived from the calling user. Not a shared service account. If the credentials live longer than the task, you diff your audit trail by a week for every incident.

What needs a human approval gate?

Irreversible or external actions: emails to customers, payments, deletions, third-party API calls, deployments. Internal read actions and easily reversible writes can run freely.

What does an agent audit log contain?

Per run: input task, each tool call with named parameters, the identity under which it ran, outputs or error states, and token/latency metrics. Enough to replay the session in your head without reading model internals.

How do I prevent runaway loops?

Hard limits in code, not in prompts: max tool calls per run, max wall-clock seconds, max token spend, max retries per tool. Prompts are a soft layer. Limits belong in the executor.

What about prompt injection through user data?

Treat all inbound data as untrusted input, never as instructions. Your tool layer is the defense: validate every call against a schema, deny by default on the tool list, and gate writes. Injection only hurts where the agent has unearned reach.

Get the DevOps Ecosystem Behind You

One accountable engineer. Full platform behind him. Month-to-month, no lock-in.

See How It Works