Review the control plane
Map human, service and agent identities, delegated permissions, tools, data, memory and external side effects.
Field guide / defensive assurance
AI agent security review: what to verify before production.
A useful review is not a scanner dump. It is a bounded answer to whether an agent can act with more authority, context or access than the system owner intended — and what evidence proves the answer.
Direct answer
Review before authority expands
Use the review before launch or before adding a tool, persistent memory, sensitive data, payment capability or a new dependency.
Include MCP when it is in scope
Inspect the MCP server card, tool schemas, authentication, validation, side effects, egress and human-approval boundaries — with written authorization.
Six questions that change the decision
Who is acting?
Can every human, service and agent action be attributed to an identity that can be independently revoked?
What can it change?
Are tools, resources, spend and side effects least-privileged at action time rather than trusted by prompt or role alone?
What context becomes authority?
Can prompt injection, retrieval results or memory writes cross a trust boundary and become durable instructions?
Which paths leave the system?
Are egress, secrets, uploads, webhooks and third-party calls explicit, validated and observable?
What happens when a tool fails?
Do timeouts, retries, malformed inputs and partial results fail closed without duplicating an irreversible action?
How is the answer proved?
Does each finding have reproducible evidence, an owner, a remediation path and a verification procedure?
Minimum evidence to prepare
- A system or data-flow view showing agents, tools, APIs, identities, memory and third parties.
- The decision the review must support: launch, authority change, risk acceptance or remediation closure.
- Tool and API schemas, permission boundaries, logging examples and safe test accounts where applicable.
- A named owner, incident contact, test window and stop conditions for any active technique.
- Data classification and an approved handling path. Never send credentials or production secrets in the first email.
What a bounded review leaves behind
The output is a decision-grade record: scope and limitations, a trust-boundary model, ranked abuse cases, evidence-backed findings, remediation ownership and one repeatable verification path.
Delx Security uses public frameworks as a vocabulary — including NIST CSF, NIST AI RMF, OWASP Agentic Top 10, OWASP ASVS and MITRE ATLAS — not as a substitute for observing the actual system.
Need to frame a real system?
Start with the five-minute readiness checklist → or compare bounded services →
Safety boundaries
- Defensive work only, on systems owned by the requester or explicitly authorized in writing.
- Active testing waits for accepted Rules of Engagement with exact assets, techniques, timing and stop rules.
- No unbounded scanning, denial of service, destructive testing, persistence, social engineering or third-party targeting by default.
- A review covers the tested scope; it does not certify an organization or guarantee future security.
Further reading
Direct answers
What is an AI agent security review?
It is a bounded assessment of an agent's identities, authority, tools, context, data flows and recovery controls. The review connects credible abuse paths to evidence, remediation and a repeatable verification step.
Does an AI agent review include MCP security?
It can. An authorized review can inspect MCP server discovery, tool schemas, authentication, input validation, side effects, egress and approval boundaries. The exact transport and targets must be written into scope.
When should a team review an AI agent?
Before production launch, before adding tools or memory, before granting access to sensitive data or spend, and after a material architecture or dependency change.
Does a security review certify that an agent is secure?
No. Delx Security reports the tested scope, evidence, limitations, findings and residual risk. It does not issue a whole-system certification or guarantee future security.