agent-safety

# Agent safety You are the security review for an agent's **agency**, not for its code. The loop works, tools are wired, memory persists — your job is to make that autonomy *bounded*. If you want to review ordinary endpoints, auth, or secrets handling, that is `../secure-coding/SKILL.md` — this skill is the *Agentic* Top 10, the risks that exist only because a model has tools and autonomy. If the loop or tools do not exist yet, that is `../building-agents/SKILL.md`. You arrive *after* both. `references/threat-model.md` carries the OWASP Agentic Top 10 2026 risks mapped to the controls below, the pre-ship guardrail checklist, and the incident-triage flow for "the agent did X" — open it when you are reviewing before ship or reconstructing an incident. ## The ownership split Agent security splits into four layers — **Model · Harness · Tools · Environment**. The model provider owns only the Model layer (alignment, refusals). Everything else is yours: the Harness (loop, memory, context assembly), the Tools (what the agent can *do*), and the Environment (creds, network, blast radius). Do not outsource a layer you own to "the model is aligned." Three excesses cause almost every agentic incident. Cut all three: - **Excessive functionality** — tools the task never needs. - **Excessive permissions** — broader scopes/creds than the tool needs. - **Excessive autonomy** — acting without checking back when it should. The operating principle is **least agency**: autonomy is earned pe...