Using AIagentssecurely.

1. 1

   Limit tools to what is necessary

   Offer only the extensions the agent needs for its task, and within them only the necessary functions: an agent that summarizes emails needs to read, not send or delete. Avoid open-ended tools such as arbitrary shell commands or URL fetches (OWASP LLM06, mitigations 1 to 3).

2. 2

   Minimize permissions

   Give each tool only the permissions it needs, for example read access to one table instead of the whole database, and run it in the context of the respective user (LLM06, mitigations 4 and 5).

3. 3

   Require approval for consequential actions

   A human confirms high-impact actions before they are executed: sending, deleting, paying, changing permissions, publishing (LLM06, mitigation 6; LLM01, mitigation 5).

4. 4

   Do not leave authorization to the model

   The target system decides according to its own rules whether an action is allowed, not the language model. Every request made through a tool is checked there against the security policy (LLM06, mitigation 7: complete mediation).

5. 5

   Treat third-party content as untrusted

   Websites, documents, emails and tool descriptions from MCP servers can contain instructions. They are processed separately and labeled, and must not trigger actions without review (LLM01, mitigation 6; MCP specification).

6. 6

   Log and limit

   Log and monitor tool calls and actions in target systems, and limit rates and budgets so that misbehavior is noticed before major damage occurs (LLM06; OWASP ASI02, mitigation 5).

An example from OWASP LLM06: an assistant that summarizes emails is built with an extension that can only read, signs in with an OAuth grant limited to read-only scope, and every email it drafts is sent only by the human after review.