Security Checklist Before Shipping an Agent to Production

Use this as a go/no-go gate before real users, real data, or real money touch an agent with tools.

Tick items only when evidence exists in code, config, or a linked doc - not when they are "planned for next sprint."

How to Use This Checklist

• Walk sections A → F in order. Earlier failures make later polish irrelevant.
• Assign an owner per section (engineering, security, platform).
• Attach artifacts: tool allowlist, network policy, secret inventory, kill-switch drill.
• Re-run after any new tool, model path, tenant type, or autonomy increase.
• Pair with Agent Security Best Practices for ongoing habits and with prompt-injection work for content-level attacks.

A - Scope, Threat Model, and Autonomy

• 1. Named use case and user population - who runs the agent, on which workflow.
• 2. Explicit non-goals - shell on prod hosts, arbitrary HTTP, unsupervised payouts, etc. listed where relevant.
• 3. Threat model written - injection via user content/tools, secret theft, data exfil, abuse of spend, lateral movement.
• 4. Autonomy level recorded - draft / recommend / supervised execute / narrow auto, with criteria.
• 5. Success and kill criteria - what metrics pause or disable the agent.
• 6. Data classes in scope - public / internal / PII / secrets / regulated, labeled for prompts and tools.

B - Tools and Least Privilege

• 7. Tool allowlist per role - no kitchen-sink registry in production.
• 8. Each tool has a single clear purpose - intent-shaped APIs, not generic supertools.
• 9. Schema validation on all tool args - types, ranges, enums, length caps.
• 10. Path/workspace jail for file tools - no host home, no secret mounts.
• 11. No blanket shell - raw run_shell absent from prod registry (or break-glass only with approval).
• 12. Irreversible actions inventory - money, delete, external send, prod change - listed with gates.
• 13. Human approval enforced in host code for high-risk actions, not only in the prompt.
• 14. Rate and amount caps - refunds, emails, rows, API calls bounded per run and per tenant.

C - Sandboxing and Execution Isolation

• 15. Untrusted code runs outside the API process - container, microVM, or equivalent.
• 16. Code sandbox network default deny - --network none or equivalent unless justified.
• 17. Read-only root + limited writable tmp for sandboxes.
• 18. Non-root user, dropped capabilities, no new privileges.
• 19. CPU / memory / PID / time limits with hard kill.
• 20. Output truncation before observations re-enter the model.
• 21. Negative tests in CI - import/network/file escape attempts fail closed.
• 22. No Docker socket or privileged mounts exposed to agent code.

D - Credentials and Secrets

• 23. Secret inventory complete - every key, token, and service account listed with owner.
• 24. No master/admin keys in the agent - scoped roles only.
• 25. Short-lived or rotatable credentials - TTL or rotation schedule documented.
• 26. Secrets never in prompts, few-shots, or model-visible tool args.
• 27. Sandbox env scrubbed - code-exec cannot read provider or DB credentials.
• 28. Per-environment keys - dev/stage/prod separated.
• 29. Spend limits on model keys - provider/key caps configured (verify at build).
• 30. Revocation path tested - can disable a key without full outage theater.
• 31. Multi-tenant isolation - no shared downstream token across customers.

E - Network Egress and Data Boundaries

• 32. Per-tool destination allowlist - named hosts, not open internet.
• 33. Metadata and link-local ranges blocked - including cloud metadata IPs.
• 34. Private network access only via named internal services - not broad RFC1918.
• 35. Redirects re-validated - SSRF-safe HTTP client behavior.
• 36. Model provider egress separated from untrusted sandbox egress.
• 37. DLP/redaction on logs and traces - secrets and raw PII stripped or access-controlled.
• 38. Tenant data isolation - indexes, caches, memory stores cannot cross tenants.

F - Runtime Controls, Audit, and Incident Readiness

• 39. Max turns / timeouts / cost budgets enforced in the host for every loop.
• 40. Kill switch - disable tools or agent globally without redeploying the whole product (drill done).
• 41. Run reconstruction - run_id, tools, policy decisions, approver, versions.
• 42. Policy versioning - allowlists and prompt/policy packs pinned per run.
• 43. Alerting - deny spikes, spend spikes, error storms, unusual destinations.
• 44. On-call runbook - secret leak, runaway loop, bad autonomous action.
• 45. Rollback - previous tool pack / prompt / model config restorable quickly.
• 46. Security review sign-off - named reviewer for first launch or major expansion.
• 47. Dependency and image patch plan - base images and tool servers on a cadence.
• 48. Untrusted content policy - tool outputs and user docs treated as data, not instructions (link to injection controls).

Evidence Pack (Attach Before Go-Live)

Minimum Gate by Autonomy Level

If you cannot staff kill switch and on-call, do not enable unsupervised execute.

FAQs

Related

• The Principle of Least Privilege Applied to Agent Tools
• Agent Security Basics
• Containerized Sandboxes for Code-Executing Agent Tools
• Scoping API Keys and Credentials Passed to an Agent
• Never Grant Blanket Shell Access in Production: What to Do Instead
• Network Egress Controls for Agents That Call External Tools
• Agent Security Best Practices
• How Prompt Injection Attacks Actually Work
• What Agent Observability Actually Needs to Capture

Stack versions: Pins from the category manifest (verify at build): OpenRouter (~315+ models, July 2026 pricing/fees); LangGraph 1.0+; CrewAI 1.14+; Microsoft Agent Framework 1.0; Vercel AI SDK 6; Pydantic AI (latest); LlamaIndex (latest); OpenAI Agents SDK (latest + MCP); MCP (Linux Foundation governance); A2A (HTTP+SSE+JSON-RPC 2.0); Solana @solana/web3.js + @solana/spl-token.