How to secure AI agents in production
Securing an AI agent requires three things that shared API keys cannot provide: a distinct, revocable identity per agent, scoped permissions that constrain what it can do, and a verifiable audit trail of everything it did. AgentTag provides all three as a layer on top of your existing MCP or A2A stack.
This page explains the AI agent threat model, AgentTag's security architecture, and best practices for teams deploying autonomous agents in production.
Why AI agents are a security risk
AI agents are powerful precisely because they can take autonomous action: calling APIs, executing code, managing files, spending money. That autonomy is also what makes them dangerous when access controls are inadequate.
The core problem is that most agent deployments rely on credential sharing— giving agents a human's API key or injecting shared secrets into the agent's environment. This creates three compounding security failures:
No scope boundary
A shared key gives the agent every permission the human has — read, write, delete, spend. There is no way to say "this agent may only read customer records" without building a custom permission layer from scratch.
No attribution
When an agent acts with a human's key, the audit log records the human as the actor. In a security incident, you cannot distinguish what the agent did from what a human did — making forensic investigation nearly impossible.
No targeted revocation
If an agent is compromised, revoking its access means rotating the shared key — which breaks every other system and agent using the same key. There is no way to cut off one agent without collateral damage.
Prompt injection compounds these risks: a malicious instruction in a tool response or document the agent reads can cause it to take actions the operator did not intend. Without scoped permissions, the only limit on the damage is what the shared key allows — which is often everything.
How AgentTag secures AI agents
AgentTag is built on three security primitives that compose with any MCP or A2A stack without replacing it:
Ed25519 cryptographic passport per agent
Every agent is issued an Ed25519 keypair bound to a W3C Decentralized Identifier (DID). The private key is stored in an isolated vault — it never appears in logs, environment variables, or agent outputs. Every request the agent makes is signed with this key. This creates a cryptographically verifiable chain from each action back to the specific agent that performed it, regardless of what shared infrastructure is involved.
Standard: Ed25519 / W3C DID · Key storage: isolated vault · Attribution: per-request signatureSigned mandates define exactly what agents can do
A mandate is a cryptographically signed JSON document specifying: which MCP tools the agent may invoke, a spend cap, actions that require human step-up approval, and an expiry date. The policy engine evaluates mandates at request time — not at agent startup — so permissions are always current. If a mandate is revoked, the change takes effect on the next request without restarting the agent. Even a successful prompt injection cannot cause the agent to exceed what the mandate permits.
Evaluation: per-request · Revocation: instant · Scope: per-tool, per-spend, per-actionHash-chained tamper-evident ledger
Every action an agent takes is recorded as a signed entry in a hash-chained ledger. Each entry includes the SHA-256 hash of the previous entry. Any retroactive modification — deleting, editing, or reordering entries — breaks every subsequent hash in the chain. The integrity of the entire ledger can be verified by anyone with the chain. You can export the full ledger and re-verify it offline at any time, independently of AgentTag's infrastructure.
Hash: SHA-256 · Chain: tamper-evident · Export: full ledger, offline-verifiableAI agent threat model
Understanding what AgentTag protects against — and what it does not — is important for designing a complete security posture.
| Threat | AgentTag protection |
|---|---|
| Credential theft / shared key leak | Each agent has its own key. Revoking one passport does not affect others. |
| Agent over-permissioning | Mandates enforce least-privilege per tool, per spend, per action. |
| Prompt injection causing unintended actions | Policy engine rejects actions not permitted by the mandate, even if the model requests them. |
| Runaway spend / API abuse | Spend caps in mandates block charges above the configured threshold. |
| Audit log tampering | SHA-256 hash chain makes retroactive edits verifiable and detectable. |
| Difficulty revoking a compromised agent | Single-step mandate revocation, effective on next request, no shared credential rotation needed. |
| Inability to attribute actions to specific agents | Every action is signed with the agent's Ed25519 key and recorded with its DID. |
| Model hallucination causing harmful actions | Step-up approval gates require human confirmation before sensitive or high-value actions proceed. |
AI agent security best practices
The following practices apply regardless of which governance tooling you use, but AgentTag is built to make all of them easy to enforce:
- 1
Give each agent its own identity
Never share credentials between agents or between agents and humans. Per-agent identity is the foundation of attribution, scoping, and clean revocation.
- 2
Enforce least privilege at the policy layer, not at the application layer
Permissions defined in application code can be bypassed by prompt injection. Permissions enforced by a policy engine that evaluates every request cannot be overridden by the model.
- 3
Use short-lived mandates
Set expiry dates on mandates appropriate to the task duration. A mandate that expires in 1 hour has a bounded blast radius even if the associated passport is compromised.
- 4
Require human approval for high-risk actions
Configure step-up approval for actions with large blast radius: deleting data, sending external communications, executing code, spending above a threshold. The agent pauses and waits for confirmation.
- 5
Export and verify your audit ledger regularly
Treat the audit ledger like an append-only log. Regularly export it and verify the hash chain. Any break in the chain is a signal of tampering.
- 6
Monitor for mandate violations
Policy rejections are signals, not just noise. An agent repeatedly attempting actions outside its mandate is a strong indicator of prompt injection or misbehaviour. Set up alerts.
Infrastructure security
AI agent security — frequently asked questions
Why are AI agents a security risk?
+
AI agents typically operate using shared human credentials that give them unscoped access to production systems. If an agent is compromised, there is no permission boundary to contain the damage, no audit trail attributable to the agent, and no way to revoke just that agent's access without rotating shared credentials.
What is the biggest security risk with AI agents?
+
Credential sharing — giving agents human API keys or shared secrets that provide unscoped, unaudited access. A secondary major risk is prompt injection: malicious instructions that cause an agent to take actions the operator did not intend. AgentTag mitigates both through scoped signed mandates and step-up human approval for sensitive actions.
How does AgentTag secure AI agents?
+
Three layers: (1) Identity — Ed25519 keypair + W3C DID so every request is cryptographically signed and attributable; (2) Policy — signed mandates define exactly what each agent can do; (3) Audit — SHA-256 hash-chained ledger that is tamper-evident and independently verifiable.
What is a tamper-evident audit ledger?
+
A ledger where each entry includes the SHA-256 hash of the previous entry. Any retroactive modification breaks every subsequent hash. AgentTag's ledger can be exported and re-verified offline.
What is prompt injection and how does AgentTag address it?
+
Prompt injection is when malicious content in a tool's response attempts to override an agent's instructions. AgentTag enforces signed mandates at the policy engine level — even injected instructions can't cause the agent to exceed what the mandate permits. Sensitive actions can require human step-up approval.
How do I revoke an AI agent's access?
+
Run `agenttag passport revoke <did>` or revoke from the control plane UI. Takes effect on the next request — no credential rotation or system restart needed. The revocation is recorded in the audit ledger.
Is MCP (Model Context Protocol) secure?
+
MCP does not define an authentication or authorisation model — it specifies communication, not permissions. AgentTag adds a security layer: each agent must present a signed, policy-checked mandate before any MCP tool call is honoured, and every call is recorded in a tamper-evident ledger.
What is least privilege for AI agents?
+
Giving each agent only the permissions it needs for its specific task: specifying which MCP tools it may call, setting a spend cap, requiring human approval above a risk threshold, and setting a mandate expiry so permissions don't accumulate. AgentTag mandates make least-privilege permissions explicit and enforceable.
Secure your first agent in five minutes
AgentTag is free during the public beta. One CLI command gives any MCP-compatible agent a cryptographic passport, a scoped mandate, and a tamper-evident audit trail.