1 / 3
Define inspection scope first
Choose targets, readable material, and tools, separately from authorization for changes or external transfers.
Evidence to retain
Targets, authorized operations, and scope unverified due to missing material.
Set AI boundaries before delegating a task
Review destinations, action authorization, and traceable records at the execution boundary.
When to use this guide
Use this when an AI reads external material and uses connected tools or services.
Separate authorized actions, actual inspection evidence, and what remains unknown.
Where to start
2 / 3
Review execution-side enforcement
Review whether the executor validates targets and operations without treating external text as permission.
Evidence to retain
Tool definitions, execution checks, and corresponding existing tests.
3 / 3
Separate observations from conclusions
Record inspected scope, evidence, and unperformed checks without including secret values.
Evidence to retain
Records linking targets, actions, and outcomes, plus evidence references for conclusions.
Apply the rules to your environment
Inspect coverage of access and administration logs →
A service needs to investigate bulk access that may resemble ordinary authenticated use.
Review authorized settings and redacted samples to see which events are recorded.
Inspect AI-agent destinations and execution privileges →
An AI reads documents and can act on code or cloud resources through tools.
Review destinations and tool definitions, separating read and write authorization.
Read the source incidents
Aflac Japan: ordinary-looking requests and bulk data queries →
Aflac reported missed detection of ordinary-looking requests and inadequate bulk-query controls. Personal information of about 4.4 million customers leaked, including bank-account information for about 220,000 of them.
Anthropic: evaluation connectivity limits failed →
Anthropic disclosed three incidents of evaluation models reaching external organizations. Misconfigured connectivity enabled abuse of weak authentication and implementation flaws.
Selected examples. Each record retains its evidence status, unknowns, and sources.
Connect terms to review questions
- Tool permission
- The destinations, resources, and operations a tool is authorized to use. Text encountered by an AI or pipeline must not grant extra authority.
- Does the execution component check that the target and operation are authorized?
- Open the related inspection rule →
- Audit log
- A record tracing the actor, time, target, and action. Exclude secret values and unnecessary personal information.
- Can you reconstruct the action, and is access to the record controlled?
- Open the related inspection rule →
- Secret
- A value granting access, such as an API key or authentication token. Review records should identify it without containing the value.
- Can you identify its purpose, target, and owner without opening its value?
- Open the related inspection rule →
Keep conclusions within the evidence
- Model answers and prompt warnings are not proof that authorization enforcement worked.
- Keep evaluation observations, real incidents, and unverified AI involvement distinct.
Giving an AI reference material and establishing evidence about a target are different stages.
References and review dates
- OWASP: AI Agent Security Cheat Sheet ↗
Tool Security & Least Privilege; Input Validation & Prompt Injection Defense; Monitoring & Observability
- OWASP: Logging Cheat Sheet ↗
Which events to log; Event attributes; Data to exclude
Learning review 2026-11-12 · Catalog review 2026-11-09
Give this scope to your AI
Share these two rules and examples without expanding the scope. Checks without evidence remain unverified.
Open this inspection pack →Explore another scenario
Check what was actually deployed
Connect the running version with the external code executed on its way to deployment.
Follow login and the session after it
Review MFA coverage separately from the mechanisms that stop an authenticated session.
Review secret handling without opening values
Map exposure paths and the process for invalidating old credentials after replacement.
Review exposure and data that remains
Review storage exposure together with the handling of retired environments and data copies.
Keep user and organization data separated
Connect resource authorization with the boundaries controlling reuse of generated responses.
Trace input into queries and file processing
Follow inputs from entry points to SQL construction and file storage or processing.
Separate the blast radius from recovery
Connect reachable resources with containment and restoration records.