Plain summary

Unauthenticated agent-to-service calls: Agent triggers external APIs without validated identity, enabling unauthorized actions
Agent impersonation (spoofed identity): Adversary or misconfigured process presents as a trusted agent to gain access.
Prompt injection bypassing auth guardrails: Crafted inputs coerce the agent to call privileged tools without proper auth check
Token theft from agent memory or logs: Secrets leaked via context windows, logs, or debug traces used to access systems.
Session hijacking for agent web actions: Stolen cookies or tokens allow attackers to drive agent browser automation.
Privilege escalation via tool chaining: Agent composes multiple tools to achieve elevated actions without explicit auth.
Shared credentials across agents or environments: Multiple agents use the same secret, making revocation and attribution ha
Missing human-in-the-loop for sensitive operations: Agents execute high-risk actions without secondary authentication or ap
Model supply chain compromise: Tampered model or tool adapter bypasses auth checks.
Weak tenant isolation for multi-tenant agents: Agents cross-access data between tenants due to missing auth context binding
Insufficient device/runtime attestation: Agent executes from untrusted runtime without attestation, enabling credential misu
Over-permissioned tool scopes: Agents receive broad permissions leading to lateral movement and data access.
Missing non-repudiation on agent actions: Inadequate signing/auditing prevents proving who executed sensitive actions.
Third-party plugin/tool weak auth: External tools used by agents have insufficient authentication or vulnerable flows.
Insufficient rate limiting + auth throttling: Brute force or token replay succeeds due to missing throttles on agent endpoints.
 Owner
Platform Security
IAM Team
AI Platform
DevSecOps
AppSec
Release Engineering
Platform Ops
Operations
Supply Chain Security
Data Platform
Cloud Security
IAM Governance
Compliance
Vendor Management
API Platform
 How to fix (plain language)
Enforce OAuth2 client credentials, short-lived JWTs, mutual TLS for services, per-agent identity.
Unique per-agent identities, RBAC/ABAC, signed requests with key rotation, attestation of agent runtime.
Out-of-band policy enforcement, capability-scoped tool wrappers, least-privilege tokens, content filters.
Secret vaulting, just-in-time tokens, redaction middleware, no-secrets-in-context policy.
Short session TTL, device binding, re-auth on sensitive actions, secure cookie flags, token binding.
Policy engine for multi-step workflows, step-up MFA for sensitive steps, signed execution plans.
Per-agent service accounts, automated secret rotation, scoping to environment and capability.
Step-up MFA + approver workflow, transaction risk scoring, intent verification UI.
Signed artifacts, SBOM, provenance attestation, runtime integrity monitoring.
Tenant-scoped tokens, per-tenant indexes, policy enforcement at vector store and tool layers.
Workload identity + attestation (SPIRE/Workload Identity), mTLS, confidential computing for sensitive workloads.
Fine-grained scopes, ABAC with contextual constraints, automated entitlement pruning.
Signed action receipts, tamper-evident logs, immutable audit store.
Security due diligence, sandboxing, egress policy, mTLS to third parties, contract SLAs.
Per-identity rate limits, token binding, nonce-based replay protection, back-off policies.
 Recommended tool/service (example)
API Gateway + OAuth2/JWT (e.g., Azure API Management + Entra ID) ; mTLS/service mesh; SIEM (Microsoft Sentinel).
Unique agent identities, RBAC/ABAC (Entra ID); key rotation in Azure Key Vault; identity protection & UEBA (Defender for Clo
Policy engine (OPA/Styra) on tool calls; least-privilege tokens; content filters (Azure AI Content Safety); review queue in Senti
Secret vaulting (Azure Key Vault); just-in-time tokens; GitHub secret scanning; DLP on logs (Microsoft Purview).
Strong session mgmt (SameSite/Secure); re-auth with Entra MFA; Azure Front Door + WAF; anomaly detection in Sentinel.
Workflow policy engine (OPA); step-up MFA (Entra); signed execution plans; approvals in Azure DevOps/Power Automate.
Per-agent service accounts; Managed Identities; automated secret rotation in Key Vault; vault health reports.
Human-in-the-loop approvals (Power Automate); step-up MFA; risk scoring; exception queues in Azure DevOps/ServiceNow.
Signed artifacts & SBOM (Sigstore Cosign, SLSA); Azure Pipeline provenance; runtime integrity/attestation.
Tenant-scoped tokens; per-tenant indexes (Azure AI Search); policy enforcement at vector store/tool layers; cross-tenant aler
Workload identity + attestation (SPIRE/AKS Workload Identity); mTLS; confidential computing for sensitive workloads.
Fine-grained scopes; Access Reviews & PIM (Entra ID); automated entitlement pruning; usage anomaly detection.
Signed action receipts (Key Vault keys); tamper-evident logs (Azure Confidential Ledger); immutable audit store.
Third-party sandboxing; mTLS/easy egress policy; Private Link; vendor risk monitoring.
Per-identity rate limiting (APIM policies); token binding/nonce; back-off policies; WAF + brute-force alerts.
 How we will monitor
API gateway auth failure/success logs, SIEM alerts for unauthenticated attempts
Behavioral analytics for agent fingerprints, impossible travel checks
Model/agent telemetry, high-risk tool call review queues
DLP on logs, vault access anomaly alerts
Session anomaly detection, geo-velocity checks
Workflow graph anomaly detection, approvals audit
Credential reuse detection, vault reports
Exception queues, approval audit
Sigstore/cosign verification logs, integrity alerts
Cross-tenant access alerts
Runtime integrity alerts
Access usage anomaly detection
Audit integrity checks
Third-party risk monitoring
Brute-force alerts, replay counters