Inventory the agent and name an accountable sponsor.
Record the purpose, owner, technical operator, data classification, model, tools, environment and review date. Name one person accountable for keeping it running.
Evidence to request
- Completed agent inventory
- Named business and technical owners
- Approved purpose and prohibited uses
- Review or expiration date
Stop ifnobody owns the decision to keep the agent running.
Give the agent its own identity.
Do not let an agent borrow a person's account or disappear behind a shared key. Use a dedicated workload identity and short-lived authentication where supported.
Evidence to request
- Unique nonhuman identity
- Documented authentication flow
- No embedded long-lived secret where federation is available
- Tested revocation procedure
Stop ifresponders cannot identify and revoke the agent on its own.
Limit it to the job it was approved for.
Limit data, tools, destinations and autonomy to what the approved job requires. Separate read access from write access and deny everything else by default.
Evidence to request
- Task-based permission matrix
- Tool and destination allowlists
- Parameter and resource restrictions
- Denied-action tests
Stop ifthe same identity can perform unrelated or higher-impact actions.
Treat retrieved content as untrusted.
A malicious instruction can hide inside a document, website, email or knowledge source the agent was allowed to read. Retrieval is an input boundary, not a trust decision.
Evidence to request
- Documented trust boundaries
- Separation between retrieved data and control instructions
- Indirect prompt-injection test cases
- Proof that content cannot silently expand authority
Stop ifone poisoned document can turn a read task into a consequential action.
Check every tool call outside the model.
The model should propose an action. Ordinary application code should then check the tool, parameters, destination, resource scope and caller authorization before anything runs.
Evidence to request
- Typed tool schemas
- Server-side validation and authorization
- Destination restrictions
- Safe handling of unexpected parameters
Stop ifpersuasive model output can get past an application control.
Require a person at the points that matter.
Pause before external communication, destructive changes, permission grants, sensitive-data transfer, financial activity or production configuration changes.
Evidence to request
- Written approval policy
- Full action, target and effect shown to the reviewer
- Consent that expires and covers one action
- Tests for rejected and expired approvals
Stop ifone model decision can create an irreversible or externally visible outcome.
Protect data through the whole workflow.
Classify prompts, retrieved documents, outputs, logs and memory. Minimize what the agent receives and keeps, and stop unauthorized movement between users, systems and destinations.
Evidence to request
- Data-flow diagram and classification
- Retrieval filters that respect who is asking
- Retention and deletion rules
- Input, output and logging controls
Stop ifthe team cannot explain where sensitive data is sent, stored, logged and deleted.
Make every action traceable.
Record who started it, the agent identity, model, retrieved sources, tool decision, validated parameters, approval, outcome and a correlation ID.
Evidence to request
- End-to-end correlation IDs
- Searchable events for consequential actions
- Alerts for unusual denials, destinations and volume
- Protected log access and retention
Stop ifresponders cannot reconstruct what the agent saw, attempted and changed.
Attack it before someone else does.
Run repeatable tests for direct and indirect injection, sensitive-data disclosure, excessive agency, unsafe output handling, tool misuse, poisoned retrieval and resource exhaustion.
Evidence to request
- Versioned set of security tests
- Clear pass and fail criteria
- Results before and after hardening
- Regression tests in the delivery pipeline
Stop ifsecurity depends only on a system prompt or a good demonstration.
Prove you can stop it and recover.
Define how to disable the agent, revoke access, cancel queued work, preserve evidence, restore affected systems and notify an incident owner.
Evidence to request
- Tested kill switch
- Credential and session revocation
- Rollback or compensation procedure
- Incident owner and scheduled review
Stop ifshutting it down means deleting shared infrastructure or waiting for the model to cooperate.
Launch, limit or stop.
Want help applying these checks to your own AI agent?
Leave a work email and QDOT can follow up about the gaps you found. The checklist stays free and open whether or not you sign up.
Want this run against your real agent?
We map what each AI system can actually reach, test the boundary with your own documents and hand you a written verdict. One scope, fixed fee, quoted in 48 hours. No discovery call.
Get a fixed quoteIf you are too early for an assessment, the form says so, and you get thirty minutes of architecture advice instead.