Frameworks from firms like KPMG and AWS emphasize that AI agents must be treated as entities with identities and permissions. A strong IAM foundation is a critical control layer to prevent agents from accessing or unintentionally leaking sensitive information, reflecting a broader shift to treat agents like any other privileged user in an IT ecosystem.

A key bottleneck preventing AI agents from performing meaningful tasks is the lack of secure access to user credentials. Companies like 1Password are building a foundational "trust layer" that allows users to authorize agents on-demand while maintaining end-to-end encryption. This secure credentialing infrastructure is a critical unlock for the entire agentic AI economy.

A practical security model for AI agents suggests they should only have access to a combination of two of the following three capabilities: local files, internet access, and code execution. Granting all three at once creates significant, hard-to-manage vulnerabilities.

Instead of relying on flawed AI guardrails, focus on traditional security practices. This includes strict permissioning (ensuring an AI agent can't do more than necessary) and containerizing processes (like running AI-generated code in a sandbox) to limit potential damage from a compromised AI.

Before deployment, teams must analyze the worst-case scenario an agent can cause based on its actual credentials, not its intended function. If any potential action leads to unrecoverable damage, that capability must be removed at the permission level, rather than attempting to control it with prompt instructions.

An AI agent capable of operating across all SaaS platforms holds the keys to the entire company's data. If this "super agent" is hacked, every piece of data could be leaked. The solution is to merge the agent's permissions with the human user's permissions, creating a limited and secure operational scope.

AI agents can cause damage if compromised via prompt injection. The best security practice is to never grant access to primary, high-stakes accounts (e.g., your main Twitter or financial accounts). Instead, create dedicated, sandboxed accounts for the agent and slowly introduce new permissions as you build trust and safety features improve.

Language models perceive secrets like API keys as simple text tokens, no different from any other word. They lack the inherent concept of privilege or confidentiality. Consequently, any secret entering an LLM's context window can be inadvertently leaked through logs, tool calls, or other outputs.

The focus of agent security is shifting from traditional identity and access management (IAM) to governing what an agent *does* with its permissions. Granting an agent access is necessary, but the real challenge is controlling the near-infinite permutations of actions it might take with that access.