# Agent Threat Model Checklist

> Companion artifact 4 of 7 — *Agentic AI Governance: Standards and Guardrails*
> R2 Digital LLC · https://ravikrali.github.io/Agentic-AI-Governance/
>
> Structured on the OWASP Top 10 for Agentic Applications (ASI01–ASI10, 2026 edition).
> Run it at design, again before release, and again whenever a tool, data source or peer
> agent is added. Budget 90 minutes with the engineer, the security architect and the
> agent owner in the room.
>
> **Controls marked HARD are deterministic — code, configuration or infrastructure.**
> **Controls marked SOFT are probabilistic — model-based screening and monitoring.**
> A soft control may supplement a hard control. It must not be the only thing standing
> between an agent and an irreversible action.

---

## 0. Scoping

| Question | Answer |
|---|---|
| Agent / use case under review | |
| Action classes in scope and their risk class (A1–A4) | |
| Autonomy tier requested | |
| Trust boundaries crossed | |
| Data classes reachable | |
| Peer agents or external parties involved | |
| Worst credible outcome in one sentence | |

---

## ASI01 · Agent goal hijack

*Injected instructions in a document, web page, ticket or tool response redirect the agent.*

- [ ] **HARD** Task contract states the objective, scope limits and stop conditions before the run
- [ ] **HARD** The set of tools available is fixed for the task and cannot be expanded mid-run
- [ ] **HARD** Actions outside the declared envelope escalate rather than execute
- [ ] **HARD** Retrieved content is passed as data in a labelled channel, never concatenated into the instruction position
- [ ] **SOFT** Input screening for injection patterns and untrusted-source instructions
- [ ] **SOFT** Plan-versus-goal consistency check before the first mutating action
- [ ] Adversarial test cases exist in the regression suite and are re-run each release

**Residual risk accepted:** ______  **By:** ______

## ASI02 · Tool misuse and exploitation

*A legitimate tool called with unintended parameters, or chained into an unintended effect.*

- [ ] **HARD** Tool allow-list per agent, per task, per tier
- [ ] **HARD** Parameter allow-lists and type/range validation at the broker, not in the prompt
- [ ] **HARD** Value, quantity and rate caps on every mutating tool
- [ ] **HARD** Tenant and record-scope binding enforced server-side
- [ ] **HARD** Idempotency key required on every mutating call
- [ ] **HARD** Circuit breaker on repeated invocation of the same action within a window
- [ ] Tools are business verbs with narrow surface area, not a mirrored API
- [ ] Tool descriptions reviewed as code, stating what the tool must not be used for
- [ ] **SOFT** Anomalous tool-sequence detection

## ASI03 · Identity and privilege abuse

*The agent acts with more authority than the principal it serves, or keeps access it should have lost.*

- [ ] **HARD** Registered agent identity; unregistered identities are rejected at every enforcement point
- [ ] **HARD** Delegated scope is the intersection of the principal's entitlements and the agent's grant
- [ ] **HARD** Short-lived, audience-restricted credentials issued per call — no standing secrets
- [ ] **HARD** Token audience validated by the receiving service; no token passthrough to downstream APIs
- [ ] **HARD** Separate identities and grants for read and write paths
- [ ] Orphan detection when the accountable owner leaves or changes role
- [ ] Access re-certification on a defined cycle for higher tiers
- [ ] Confused-deputy review: can the agent be induced to use its own authority on someone else's behalf?

## ASI04 · Agentic supply chain compromise

*A malicious or hijacked MCP server, skill, prompt pack or model enters the runtime.*

- [ ] **HARD** Private registry is the only load path; remote definitions are not resolved at runtime
- [ ] **HARD** Artifacts signed and version-pinned; signature verified at load
- [ ] **HARD** Egress deny-by-default from the agent runtime
- [ ] Software bill of materials produced and stored per release
- [ ] Third-party MCP servers vendored, reviewed and owned internally
- [ ] Tool-squatting check: can a name collision route a call to the wrong server?
- [ ] Model and prompt versions pinned; upgrades go through the release gate

## ASI05 · Unexpected code execution

*Generated code runs with real credentials or reaches the network.*

- [ ] **HARD** Ephemeral sandbox per execution, destroyed after the run
- [ ] **HARD** No production credentials present in the execution environment
- [ ] **HARD** Network egress allow-list from the sandbox
- [ ] **HARD** Filesystem scope limited to the task working directory
- [ ] **HARD** CPU, memory and wall-clock limits enforced by the runtime
- [ ] Generated code carries provenance and is reviewed before it reaches a shared branch
- [ ] Secret scanning on anything the agent writes

## ASI06 · Memory and context poisoning

*False facts written to durable memory persist and are trusted later.*

- [ ] **HARD** Provenance required on every durable memory write; writes without it are rejected
- [ ] **HARD** Memory scoped to user or tenant; no cross-tenant reads
- [ ] **HARD** TTL on durable entries; promotion from task memory is an explicit step
- [ ] **HARD** Retrieval filtered by principal entitlement at chunk level *before* ranking
- [ ] Correction and deletion path exists and is tested
- [ ] Poisoning cases in the regression suite
- [ ] **SOFT** Conflict surfacing when sources disagree, rather than silent resolution

## ASI07 · Insecure inter-agent communication

*Agents trust each other's messages without verifying sender or authority.*

- [ ] **HARD** Mutual authentication between agents; TLS everywhere
- [ ] **HARD** Peer allow-list; unknown peers cannot initiate work
- [ ] **HARD** Original principal scope propagated and re-evaluated at the receiving agent
- [ ] **HARD** Authorization checked on protocol operations at the receiver, not assumed from the caller
- [ ] Peer output treated as untrusted input and screened on arrival
- [ ] Agent cards for peers reviewed; declared auth schemes verified
- [ ] Cross-organizational calls carry an explicit contract and a named owner on both sides

## ASI08 · Cascading agent failures

*One bad output becomes another agent's trusted input and the error multiplies.*

- [ ] **HARD** Step, token, spend and wall-clock budgets bound at task start
- [ ] **HARD** Maximum delegation depth and fan-out
- [ ] **HARD** Circuit breakers on repeated failure, repeated action and error-rate thresholds
- [ ] **HARD** Blast-radius cap per action class (records touched, value moved, tenants affected)
- [ ] **HARD** Automatic rollback bound to each mutating action class
- [ ] Confidence thresholds cause escalation rather than continuation
- [ ] **SOFT** Guardian monitoring of action sequences — *supplementary, not the boundary*
- [ ] Failure injection tested: what happens when a peer returns confident nonsense?

## ASI09 · Human-agent trust exploitation

*Confident output plus approval fatigue produces a rubber stamp.*

- [ ] Approvers see the diff and the underlying evidence, not only a summary
- [ ] The approval record captures what was actually shown
- [ ] Approval volume per reviewer is capped and monitored
- [ ] Approvers rotate; sample audits of approved actions run on a cadence
- [ ] Dual control required for the highest risk class
- [ ] Approval expiry: a stale request cannot be executed later
- [ ] Time-to-decision tracked — very fast approvals are a fatigue signal
- [ ] Users are told an agent is involved and can reach a person

## ASI10 · Rogue agents

*An unregistered, forgotten or compromised agent operating outside all of the above.*

- [ ] **HARD** Registry is the allow-list; the gateway and every enforcement point check it
- [ ] **HARD** Network egress control prevents ungoverned paths to models and tools
- [ ] **HARD** Automatic expiry on every registration
- [ ] Discovery scanning for unregistered agent traffic and shadow deployments
- [ ] Kill switch covers per-agent, per-tool and global scope — last tested: ______
- [ ] Behavioural baseline per agent; deviation alerts to the owner
- [ ] Decommissioning revokes identity, credentials, memory scope and peer trust

---

## Cross-cutting

- [ ] **AS-11** Evidence is written before the action; failed logging fails the action
- [ ] **AS-05** No ungoverned path exists to any model, tool, memory or retrieval surface
- [ ] Policy bundle version recorded on every decision, so any run can be replayed
- [ ] Incident drill run for this agent's worst credible outcome — date: ______
- [ ] Retention and deletion obligations identified for every data class touched

## Sign-off

| Role | Name | Date | Findings open |
|---|---|---|---|
| Agent owner | | | |
| Security architect | | | |
| Engineering lead | | | |
| Risk / compliance partner | | | |

**High and medium findings must be closed before release. Low findings need an owner and a date.**