How to secure an AI agent

The six steps

1. 1

   Enumerate the tool-call surface

   Estimated: 15 min

   List every tool your agent can call — database, shell, HTTP, email send, file write, code execution. Group into read-only, write, and side-effectful. Read-only tools default to allow; write and side-effectful tools go through classification.

   Concretely: For a LangChain agent: iterate agent.tools and label each. For Anthropic tool_use: enumerate tools[] in the API call. For OpenAI: iterate tools[] in the response. This step is required — 86% of harm in agent deployments happens at the tool-call boundary, not in the prompt.

2. 2

   Instrument the framework with a tool-call gateway

   Estimated: 10 min

   Add a runtime layer between the LLM's tool-call decision and the tool's execution. In the AEGIS SDK this is a two-line change: import agentguard; agentguard.auto(). The SDK monkey-patches all detected framework SDKs at import time; existing agent code is unchanged.

   Concretely: Supported frameworks: Anthropic, OpenAI, LangChain, CrewAI, Gemini, Bedrock, Mistral, LlamaIndex, smolagents (Python); Anthropic, OpenAI, LangChain, Vercel AI SDK (JS/TS); Go. See https://github.com/Justin0504/Aegis for the full list.

3. 3

   Configure a three-layer classification cascade

   Estimated: 30 min

   A single detector is either too brittle (regex misses 98%+ of real attacks in our benchmark) or too expensive (LLM judges cost $0.36–$5.32 per run at 1–2 s latency). The Pareto-optimal defence is a cost-aware cascade: deterministic rules for known-bad patterns (L1), a supervised classifier over structural features (L2), and an LLM judge for the small ambiguous residual (L3).

   Concretely: AEGIS ships this cascade out of the box: L1 = 22 patterns × 7 categories, L2 = XGBoost over 15 features, L3 = Claude Haiku. On the 5,525-record ToolGuard-Bench (arXiv:2603.12621), the cascade achieves 99.9% block rate at 1.06 ms P50 latency and $0.05 total run cost.

4. 4

   Add a human-in-the-loop approval queue for high-risk calls

   Estimated: 20 min

   Not every risky call should be auto-blocked — some legitimate calls look suspicious (e.g. an admin script deleting old records). Route calls above a risk threshold to a pending queue where a reviewer sees the full argument JSON, risk signals, and can approve or reject in one polling cycle.

   Concretely: The AEGIS Compliance Cockpit ships this queue with SDK-level suspension: the agent pauses execution while the reviewer decides, then resumes on approval within one polling cycle (typically 2 s). Reviewers can grant one-shot approval or persist the decision as a new policy rule.

5. 5

   Log every decision to a tamper-evident audit chain

   Estimated: 10 min

   Plain database logging fails covered-entity review (HIPAA §164.312(b)) and EU AI Act Article 12 compliance because a database row is trivially editable by anyone with DB access. Use a cryptographic hash chain (SHA-256) with per-agent Ed25519 signatures so the audit log is third-party verifiable — the standard RFC 6962 uses for SSL certificate transparency.

   Concretely: AEGIS ships a 245-line Node stdlib verifier that runs air-gapped; auditors can validate Merkle inclusion + consistency proofs without trusting AEGIS. See https://github.com/Justin0504/Aegis/tree/main/tools/verify-log.

6. 6

   Wire alerts on repeated blocks + PII exposure to Slack / PagerDuty

   Estimated: 15 min

   A compromised agent typically triggers many blocks in a short window before the operator notices. Alerting on ≥3 blocks per agent per hour catches compromise early; alerting on any PII-in-args event catches the accidental leak scenarios.

   Concretely: AEGIS ships native destinations for Slack (Incoming Webhooks) and PagerDuty (Events API v2). Configuration is in the Compliance Cockpit → Settings → Alert Rules. Both destinations are open-source; no vendor lock-in.