[Blog](https://cohesivity.ai/blog) Reliability & production Published Jul 26, 2026·Updated Aug 30, 2026 ![](https://cohesivity.ai/authors/anshu.webp)![](https://cohesivity.ai/authors/arag.webp)[Anshu](https://www.linkedin.com/in/aanshuaggrawal120/) and [Arag](https://www.linkedin.com/in/aragagrawal/) # AI Agent Security: Identity, Permissions, Secrets, and Audit Logs [Read as Markdown](https://cohesivity.ai/blog/ai-agent-security-identity-permissions-secrets-audit-logs.md) Trust Identity Permission Secrets Audit trail AI agent security starts by binding every action to a represented identity, tenant, resource, and permission. Keep provider credentials outside model context, enforce authorization in the downstream service, require approval before high-impact effects, and record decisions and outcomes for investigation. A system prompt can shape behavior, but it cannot reduce the capability of an administrator token available to the tool process. ## Carry identity through the whole action An agent run may involve a human user, an application tenant, an agent deployment, a session, and a background worker. Preserve those identities separately. ```mermaid flowchart LR User[Authenticated user] --> Session[Agent session] Session --> Policy{Tenant, resource, action} Policy -->|allow| Tool[Server-side tool] Tool --> Credential[Scoped provider credential] Credential --> Backend[Downstream service] Policy --> Audit[Decision record] Backend --> Audit ``` The backend should receive enough context to authorize the represented user and tenant. If a shared worker credential is unavoidable, the tool adapter must apply the missing resource rule before using it. The [agent control plane guide](https://cohesivity.ai/blog/how-to-design-an-agent-control-plane) shows where those decisions and credential references belong. ## Reduce permissions at the credential and API layers Give an agent only the actions and resources required for its current job. Separate read, write, provision, billing, and administrative credentials. Scope by tenant and environment, then shorten credential lifetime where the provider supports it. Do not expose broad primitives when a task-level operation is sufficient. `refund_order(order_id, amount)` can enforce ownership, amount bounds, approval, and idempotency. A generic SQL or provider-admin tool transfers all those decisions to generated arguments. OWASP’s [Excessive Agency guidance](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) recommends minimizing tool functionality, permissions, and autonomy. The backend remains responsible for authorization even when the model selected a valid tool. ## Keep secrets outside the model path Store secrets in a server-side manager and pass references through application code. Inject a task-scoped credential into the smallest runtime that needs it, then revoke or expire it. Secrets commonly leak through: - prompts and retrieved context; - tool arguments or descriptions; - URLs and query strings; - exception messages and stdout; - traces, replay data, and support exports; - sandbox files and inherited environment variables. Redact before export and test errors deliberately. Never ask a model to repeat or transform a secret. For MCP connections, the current [authorization specification](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization) requires access tokens in the Authorization header and says servers must reject tokens in the URI. ## Place approval before the effect Require approval for destructive, financial, externally visible, or unusually broad actions. Show the exact resource, parameters, and consequence. Bind the approval to those values and expire it. Recheck permission at execution time. A user’s role or resource ownership can change while an operation waits. Approval does not grant authority the approver lacks. Railway’s [April 2026 incident report](https://blog.railway.com/p/your-ai-wants-to-nuke-your-database) describes an agent finding an account token and calling a legacy immediate-delete API. Railway recovered the volume and changed API deletion to a 48-hour soft-delete path. The lesson is concrete: token scope, API behavior, and reversibility matter together. ## Treat retrieved content as untrusted input A webpage, email, issue, or document may contain instructions aimed at the model. Keep data separate from trusted system policy, and never let retrieved text expand tool permissions. Require a fresh policy check for the action the model proposes. Use allowlists for network destinations and resource types when the workflow is narrow. Mark external content provenance in traces so an investigator can see what influenced the action without treating that content as authority. ## Write audit records that support containment Record the actor, represented user, tenant, agent and session, tool, resource, action, policy version, decision, approval reference, operation ID, timestamp, and outcome. Keep “allowed” separate from “completed.” Do not store secrets or unlimited model content in the audit log. Link to protected traces when detailed context is required. The audit path should answer which credentials to revoke and which resources may have changed without relying on the agent that failed. ## Test revocation and cross-tenant denial In an isolated environment: 1. revoke a session while a task is waiting and verify resume fails safely; 2. attempt another tenant’s resource ID through every tool path; 3. inject hostile instructions into retrieved content; 4. trigger provider and validation errors, then inspect logs for secrets; 5. ask for a destructive action without approval and confirm no downstream call occurs. The [production checklist](https://cohesivity.ai/blog/the-production-ai-agent-checklist) connects these controls to retries, traces, and recovery. The prompt below builds the actual permission matrix from code. Any row whose enforcement point is “system prompt” is unfinished security work. or send it to[Claude Code](https://claude.ai/new?q=Inspect+this+repository%27s+AI+agent+identities%2C+tools%2C+secrets%2C+and+authorization+checks.+Do+not+reveal+secret+values%2C+edit+code%2C+or+call+external+services.+Build+a+matrix+of+each+agent+or+session%2C+represented+user%2C+tenant+scope%2C+credential+reference%2C+permitted+resources+and+actions%2C+approval+gates%2C+downstream+enforcement+point%2C+audit+event%2C+and+revocation+path.+Compare+actual+credential+capability+with+tool+descriptions+and+prompts.+Flag+shared+administrator+keys%2C+model-supplied+tenant+IDs%2C+secrets+entering+prompts+or+logs%2C+and+actions+enforced+only+by+instructions.+Rank+the+smallest+fixes+by+consequence. "Send to Claude")[Cursor](https://cursor.com/link/prompt?text=Inspect+this+repository%27s+AI+agent+identities%2C+tools%2C+secrets%2C+and+authorization+checks.+Do+not+reveal+secret+values%2C+edit+code%2C+or+call+external+services.+Build+a+matrix+of+each+agent+or+session%2C+represented+user%2C+tenant+scope%2C+credential+reference%2C+permitted+resources+and+actions%2C+approval+gates%2C+downstream+enforcement+point%2C+audit+event%2C+and+revocation+path.+Compare+actual+credential+capability+with+tool+descriptions+and+prompts.+Flag+shared+administrator+keys%2C+model-supplied+tenant+IDs%2C+secrets+entering+prompts+or+logs%2C+and+actions+enforced+only+by+instructions.+Rank+the+smallest+fixes+by+consequence. "Send to Cursor")[Codex](https://chatgpt.com/codex?prompt=Inspect+this+repository%27s+AI+agent+identities%2C+tools%2C+secrets%2C+and+authorization+checks.+Do+not+reveal+secret+values%2C+edit+code%2C+or+call+external+services.+Build+a+matrix+of+each+agent+or+session%2C+represented+user%2C+tenant+scope%2C+credential+reference%2C+permitted+resources+and+actions%2C+approval+gates%2C+downstream+enforcement+point%2C+audit+event%2C+and+revocation+path.+Compare+actual+credential+capability+with+tool+descriptions+and+prompts.+Flag+shared+administrator+keys%2C+model-supplied+tenant+IDs%2C+secrets+entering+prompts+or+logs%2C+and+actions+enforced+only+by+instructions.+Rank+the+smallest+fixes+by+consequence. "Send to Codex")[opencode](https://opencode.ai/?q=Inspect+this+repository%27s+AI+agent+identities%2C+tools%2C+secrets%2C+and+authorization+checks.+Do+not+reveal+secret+values%2C+edit+code%2C+or+call+external+services.+Build+a+matrix+of+each+agent+or+session%2C+represented+user%2C+tenant+scope%2C+credential+reference%2C+permitted+resources+and+actions%2C+approval+gates%2C+downstream+enforcement+point%2C+audit+event%2C+and+revocation+path.+Compare+actual+credential+capability+with+tool+descriptions+and+prompts.+Flag+shared+administrator+keys%2C+model-supplied+tenant+IDs%2C+secrets+entering+prompts+or+logs%2C+and+actions+enforced+only+by+instructions.+Rank+the+smallest+fixes+by+consequence. "Send to OpenCode")