Agent identity / Non-human identity (NHI)
Treating each agent as its own first-class principal with a managed, authenticated identity and tightly scoped permissions, rather than letting it borrow a human user's session or credentials. A core mitigation for identity and privilege abuse.
Approval workflow / Break-glass
A defined process requiring explicit human authorisation for high-consequence actions, with an auditable emergency-override ("break-glass") path for exceptional cases.
Defense in depth
Layering multiple independent controls (input guardrails, scoped tools, sandboxing, monitoring, human approval) so that the failure of any one does not lead to compromise.
Dual-LLM / Privileged-quarantined pattern
An architecture that separates a privileged model (which can act, but never sees untrusted data directly) from a quarantined model (which processes untrusted content, but cannot act). Limits the reach of injected instructions.
Egress filtering / Network allowlisting
Restricting the destinations an agent can send data to or fetch from, so that even a hijacked agent cannot exfiltrate to arbitrary endpoints.
Least agency
The agentic extension of least privilege: an agent's autonomy — how far it can act without checking back — should be the minimum the task requires and earned rather than granted by default. Coined in the OWASP Agentic guidance.
Least privilege
Granting an agent (and its tools and credentials) only the minimum access required for its task, for the minimum time. The single most effective limiter of blast radius.
Observability / Audit logging / Tracing
Recording an agent's inputs, decisions, tool calls, data access, and outputs in a tamper-resistant, reviewable form. Essential for detecting rogue behaviour, investigating incidents, and producing compliance evidence.
Red teaming
Structured adversarial testing of an AI system — attempting jailbreaks, injections, and goal-hijacks — to surface weaknesses before attackers do.
Sandboxing
Running an agent's tool calls or code execution in an isolated environment with no access to production systems, secrets, or the network beyond what's explicitly permitted. Contains the impact of unexpected code execution.
Scoped / Ephemeral credentials
Short-lived, narrowly-permissioned tokens issued per task or per session, so that a leaked credential is of limited use and expires quickly.
Spotlighting / Data tagging
Techniques that mark untrusted content (delimiters, encoding, metadata) so the model can distinguish data it should process from instructions it should obey, reducing indirect injection.
Trust boundary
A line in the architecture across which data or instructions should not be implicitly trusted. Agentic systems blur traditional boundaries because natural-language content can carry executable intent; explicit boundaries must be re-established.
Zero trust
A security model that assumes no implicit trust based on network location or prior authentication; every request is verified, authorised, and minimised. Maps naturally onto agents as continuously-verified, least-privileged principals.
