AI Agent Security Review Checklist
Use this checklist when a Work Slice includes external, retrieved, remembered, monitored or tool-returned content that may influence agent behavior.
1. Source classification
- What source is being interpreted?
- Is it framework rule, project-local rule, user request, tool output, retrieved content, memory or external/monitored content?
- Does it have
source_refs? - Is missing provenance marked
unavailable?
2. Instruction authority
- Is the content trying to issue instructions?
- Does it have authority to change scope, policy, tool use, validation or role?
- If not, has it been transformed into context/evidence rather than followed?
3. Prompt-injection signals
Check for attempts to:
- ignore or override prior instructions;
- reveal hidden/system/project policy;
- bypass validation or human gates;
- call tools outside the declared envelope;
- treat untrusted content as approval;
- move data across trust boundaries.
4. Tool boundary
- Is the requested action read-only, write-local, write-external, communication, identity/security-sensitive or destructive?
- Does the active harness envelope allow it?
- Is human approval required?
- Could a safer read-only interpretation answer the task?
5. Retrieval and memory safety
- Is retrieved memory current, source-backed and in scope?
- Could the retrieval result be poisoned, stale or over-broad?
- Are retrieved fact, inference and instruction separated?
6. Decision posture
Choose one:
allow_read_only— inspect/summarize without following embedded instructions.transform_to_context— preserve the content as evidence/context only.require_human_review— ambiguity or high-risk boundary crossing.block— clear unsafe request or authority violation.
7. Closure evidence
Before closure, confirm:
- suspicious source refs are recorded;
- governing source refs are recorded;
- unavailable fields remain unavailable;
- the result does not claim perfect prompt-injection defense;
- no runtime, scanner or new enforcement layer was implied.