AI agent security checklist: what to get right before you ship
An AI agent that can read your CRM, send messages, and take actions on a customer's behalf is powerful, and every one of those capabilities is also a new failure mode. Eight checks cover most of what goes wrong in production. Click through the diagram below for the short version, or keep reading for the long one, then run the checklist at the end against your own build.
Rate limiting
Protects against
Abuse, DDoS, API flooding, and runaway AI bills from a single bad actor or a misbehaving loop.
Implement
- Limit requests per IP, per user, per API key, and per session
- Cap automated replies per contact within a rolling window
- Alert yourself when usage spikes outside a normal range
Example
A script hammers your webhook 500 times a second, tries to rack up a five-figure model bill, and hits a wall at request 20.
1. Rate limiting
Protects against: Abuse, DDoS, API flooding, and runaway AI bills.
An agent with no ceiling on how often it can be called is one bad actor, one broken retry loop, or one viral moment away from an unbounded bill or a flooded channel.
- Limit requests per IP, per user, per API key, and per session
- Cap automated replies per contact within a rolling window
- Alert yourself when usage spikes outside a normal range
2. Authentication & authorization
Protects against: Unauthorized users or systems reaching the agent or its tools.
The agent and every tool behind it needs to know who is asking, not just what they're asking for.
- API keys or OAuth/JWT on every entry point
- Roles and permissions, not one shared admin credential
- Short-lived tokens for anything that touches customer data
3. Prompt injection protection
Protects against: A user, a document, or a webpage smuggling instructions into the agent instead of the plain-language message it looks like.
Prompt injection is the new SQL injection. Anything a user, a document, or a webpage can put in front of the model should be treated as data, not instructions.
- Treat every inbound message and tool result as data, not instructions
- Separate system instructions from user content in the prompt
- Validate structured tool output before it reaches the model again
4. Tool permissions
Protects against: The agent doing something it was never meant to do.
An agent should only be able to call the tools and data it actually needs for its job, nothing more.
- Read access before write access, write before delete
- Scope lookups to the current contact, not the whole table
- Spend, refund, and send limits on any tool that takes action
5. Human approval
Protects against: Irreversible actions going out without a person ever seeing them.
Anything that can't be undone, refunds, deletions, cancellations, contract sends, should have a confirmation step or a human approver in the loop.
- Confirmation step before payments, refunds, or cancellations
- A clear handoff path the moment a human is actually needed
- No silent execution of anything a support rep would normally escalate
6. Data protection
Protects against: PII, passwords, and customer data leaking through prompts, logs, or a compromised tool.
The model only needs enough context to help, not your entire customer record.
- Encrypt data at rest and in transit, manage secrets outside the prompt
- Mask card numbers, government IDs, and other sensitive fields
- Give the model only the fields a reply actually needs
7. Input/output validation
Protects against: Malicious URLs, SQL, shell commands, XSS, or malformed tool parameters slipping through either side of the conversation.
Validate what comes in from the user and what comes out of the model as a tool call. Neither side gets a free pass just because it's 'just text.'
- Validate user input the same way you would on any public form
- Validate AI-generated tool calls before they execute, not after
- Reject or sanitize anything that doesn't match the expected shape
8. Logging & monitoring
Protects against: Attacks, failures, and quiet drift going unnoticed because nobody was watching.
You need an audit trail of what the agent saw, what it decided, and which tools it called, and someone actually watching that trail, not just the final reply.
- Log every request, tool call, and failure alongside the conversation
- Track escalation rate and tool errors as an ongoing metric
- Alert on anomalies instead of finding them in a monthly review
The self-check
Go through your own agent against these eight before it touches a real customer.
Run this before you ship
0/8 completeSaved in this browser only. Nothing is sent anywhere.
By Piyush Sachdeva.
Founder of Social Masla. Creator of Pulse. Best-selling author of The Growth Engine: Beyond AI and Advertising.
An agent built
compliant by default.
Pulse's WhatsApp AI agent scopes its own tools, discloses itself on the first reply, and hands off to your team the moment a human is needed.
Discuss your build