Security, Safety & Guardrails

• Deterministic checks pre-call, in-loop and post-call
• Prompt-injection and jailbreak defence, including on retrieved content
• PII and PHI detection and redaction in both directions
• Output validation against schema and policy before anything executes
• Non-human identity: one identity per agent, tool and server; just-in-time scoping
• Supply-chain controls: signing, scanning, pinning, SBOM and AIBOM
• Circuit breakers and kill switches with a tested revocation path

Security Engineering / CISO organisation

• CISO — accountable owner
• Application security engineer — guardrails and validation
• IAM architect — non-human identity and just-in-time scoping
• Red team — adversarial testing against the deployed system
• Privacy engineer — detection, redaction, minimisation
• Incident responder — agent-specific runbooks

Architectural recommendation, not a research finding.

Pilot needs injection screening, PII redaction, output validation and workload identity. Full supply-chain control and inter-agent security are mandatory before production data or write access.

Signals to watch

• Attack success rate, always published with the harness and judge configuration
• Injection attempts detected and blocked
• Coverage of just-in-time credentials versus static keys
• Unsigned or unscanned artefact loads blocked
• Mean time to detect and to revoke a misbehaving agent

1. Prompt injection arriving through retrieved documents, tool descriptions or peer agents rather than the user
2. Static API keys standing in for agent identity
3. Guardrails only at the edge, so anything inside the loop is unprotected
4. An agent able to do more than the human it acts for
5. Third-party MCP servers and skills trusted without scanning or pinning

Tool and standards snapshot · last reviewed approximately mid-2026