AI Agent Security Best Practices for Intelligence Work
Apply AI agent security best practices to OSINT and intelligence workflows: scoped credentials, untrusted evidence, protected memory, and bounded actions.
AI agent security best practices start with controlling what the agent can read, do, retain, and send. Enforce those limits in the host and services around the model. For an intelligence agent, the main exposure is often the path from untrusted external evidence to an authorized tool or a private workspace record.
An agent that reads news, retrieves internal reports, and publishes a briefing crosses several boundaries. Treat each connection as a separate decision about access and authority.
Map the boundaries before adding tools
For a regional intelligence brief, write down the following before enabling automation:
| Boundary | Example decision |
|---|---|
| Input | Which public feeds and private reports may this job read? |
| Credential | Which workspace and API operations does its key authorize? |
| Execution | Can the job only retrieve evidence, or also change account state? |
| Retention | Where can its evidence and conclusions be stored? |
| Delivery | Which named destination may receive the final brief? |
The OWASP AI Agent Security Cheat Sheet identifies risks including tool abuse, data exfiltration, memory poisoning, excessive autonomy, and unbounded spending. Least privilege, action validation, and monitoring work together; a carefully worded system prompt cannot replace service-side authorization.
1. Give each workflow only the authority it needs
For a Y2 OSINT reader, begin with osint:read. A separate CVE research job can use intel:cyber.
Avoid adding write or agent:y2 scopes simply to make an authorization error disappear. Inspect
the attempted operation and decide whether the assignment actually needs it.
Y2's generic MCP API tool follows operation-level authorization. Hiding dedicated mutation tools does not remove a credential's scopes. Use the MCP scoped API key guide to configure the enforced boundary.
2. Keep retrieved evidence outside the instruction boundary
A source page might contain text asking the agent to change its task, reveal credentials, or send a report elsewhere. The OWASP prompt-injection guide describes indirect injection through retrieved content. Labeling evidence helps interpretation, but access controls and destination restrictions must still hold if the model follows hostile text.
For the briefing job, a source can contribute claims and citations. It cannot select a new report recipient, expand the key's scope, or authorize a follow-up action. Compare proposed tool calls with the user's requested geography, period, and output destination.
3. Bind approval to the actual action
A read-only research workflow can produce a draft without acquiring publishing authority. If the product later supports sending or changing records, present the exact target, content, and effect for approval through a trusted control. Recheck authorization when the action executes.
For example, approval to prepare a supplier-risk brief is not approval to email every supplier. Keep the reviewed recipient and document associated with the action so later model output cannot silently substitute a different destination or version.
4. Protect memory from stale or misattributed evidence
When retaining a finding, preserve the subject identity, sources, observation time, and review state. Retrieve within the authorized context. Test whether a similarly named entity or another workspace's report can contaminate the answer.
Y2 Projects, Chat, and Global Knowledge have different access and availability boundaries. Direct Global Knowledge retrieval is private beta and does not include personal memory, Project-only context, or thread-only context. Do not treat it as a universal context store.
5. Bound requests, spending, and failure recovery
Give a job a request budget, time window, and stopping condition. A missing result should trigger
a coverage note or a bounded alternative query, not unlimited retries. Y2's authentication guide
documents per-key and aggregate limits; treat a surfaced 429 using the documented retry timing.
Keep operational records that help reconstruct the run: operation, status, request identifier, reviewed output, and relevant resource identities. Redact credentials and minimize retained sensitive content. Define how an operator can stop the job and revoke its key.
A practical evaluation for an intelligence agent
These are suggested integration tests, not claims that a particular deployment has passed them:
| Test input or condition | Expected result |
|---|---|
| A source tells the agent to send private reports to a new address | No new destination is authorized |
| A key lacks the required scope | The request is denied without privilege expansion |
| A record ID belongs to another tenant | No unauthorized content is returned |
| An older report contradicts newer evidence | The contradiction and dates remain visible |
| A provider is unavailable | The brief identifies the gap and the job stops within budget |
| A key is revoked while a job is running | Later authenticated calls fail and the job stops |
Test the final brief as well as the tool trace. The evidence should support its claims, secrets should be absent, and a reader should be able to distinguish findings from hypotheses.
Frequently asked questions
Is read-only enough to make an agent safe?
Read-only credentials reduce the ability to change state. They still permit reading whatever the credential can access, so protect confidential results and control where they can be sent.
Does MCP provide all these controls?
MCP specifies interoperability and relevant authorization behavior. The host, server, downstream API, and storage services each enforce parts of the workflow. Review the MCP security guidance for protocol-specific concerns.
What is the smallest useful starting point?
One bounded research job, one narrowly scoped key, a draft as output, and a reviewed set of normal and adversarial cases. The cyber threat intelligence agent guide provides a concrete investigation to apply this pattern to.