FREE CHECKLIST
Agentic AI Runtime Security Checklist
Sixteen gates to assess before an AI agent is allowed to act against production systems. Every one is a property of your infrastructure rather than of the model — a control the agent cannot reason its way around.
1 · Architecture & execution
In-line enforcement. The control sits in the execution path, not beside it. A decision made after the action has left is a record, not a control.
A latency budget. Enforcement resolves locally rather than over a network round-trip, so governance does not become the reason a team disables it.
Local residency. The decision is made inside your own trust boundary — a service in your VPC or a sidecar beside the agent.
Policy versioning. Policies can be versioned, diffed, reviewed and rolled back like any other code.
2 · Behavioural & policy governance
Deterministic rules. The verdict is binary and reproducible. A probabilistic control gives you a risk tolerance, not a guarantee.
Tool-call mapping. The stated intent is checked against the actual tool parameters, not just the prompt.
Credential isolation. Credentials are task-scoped and short-lived rather than standing and ambient.
Scope boundaries. Allowed domains, repositories and buckets are enforced at the boundary, not requested in the system prompt.
4 · Pre-production assurance
Evaluated before it ships. The agent is assessed against a battery before it reaches production, rather than being observed carefully once it is already acting.
An immutable snapshot. What was tested is exactly what deploys. If the agent can change between the verdict and the deployment, the verdict describes something else.
Acceptance bars set first. The pass mark is agreed before the run, not chosen after seeing the numbers.
Verdicts that expire. “Safe to deploy” is invalidated when the policy, the model or the environment moves underneath it.
3 · Compliance & human oversight
Escalation that holds. A high-liability action waits for a human decision rather than proceeding with one logged afterwards.
Contextual audit trail. Every action is recorded with the decision and the rule that produced it, at the time it was made.
Separation of duties. Whoever authors a policy is not whoever approves or executes against it.
Fail-closed logic. When the policy path is unavailable, the action is denied. Failing open turns an outage into an incident.