Prompt injection is the #1 risk on the OWASP LLM Top 10 (OWASP, 2025). Agents amplify every LLM risk by adding tools, persistence, and autonomy. This checklist gives you 47 controls across 10 categories. Each control has an action, a verification step, and a default failure mode. Fork it into your wiki. Pair it with the blast radius post for the deep dive on bounding levers, and the monitoring playbook for how to see what the agent did.

Identity (5 controls)

  1. Per-agent service identity. Verify: every agent run has a unique principal in the IAM system, not a shared user. Default failure: shared service account.
  2. Short-lived tokens, not long-lived keys. Verify: tokens minted per run, TTL ≤ run duration plus 5 minutes. Default failure: an API key in an env var that never rotates.
  3. Per-run audit attribution. Verify: trace logs show the agent identity that performed each action. Default failure: shared identity, no attribution.
  4. End-user identity propagation. Verify: downstream services see the original user identity, not the agent's. Default failure: agent acts as god-user.
  5. Federation with the existing IdP. Verify: agents authenticate through the company's SSO, not a parallel identity store. Default failure: a separate "AI users" directory.

Secrets and credentials (5 controls)

  1. Secrets in a vault, not in env vars. Verify: code search finds no secrets in source. Default failure: GitHub Actions secret leaking via echo.
  2. Rotate keys on a schedule. 90 days for production, 30 for high-privilege. Verify: rotation log shows last rotation date per key. Default failure: keys older than the engineer who set them.
  3. Per-tenant secret scopes. Verify: tenant A's vault path differs from tenant B's. Default failure: shared umbrella key.
  4. Just-in-time secret access. Verify: agent fetches secret at run start, not at boot. Default failure: secret in memory for the life of the process.
  5. Secret scanner in CI. Verify: CI fails on detected secrets. Default failure: detect-secrets disabled "for now".

Tool scoping and blast radius (6 controls)

  1. Per-tool capability scope. Verify: tool registry shows explicit scope per tool. Default failure: tool accepts arbitrary SQL.
  2. Default read-only. Verify: a fresh agent has no write capability. Default failure: admin defaults applied at provisioning.
  3. Capability TTL. Verify: grants expire. Default failure: forever grants.
  4. Per-tool rate limits. Verify: rate limit fires platform-side. Default failure: limit in the prompt only.
  5. Spend cap per tool. Verify: a transaction above cap is rejected before tool fires. Default failure: cap tracked, not enforced.
  6. Reversibility tier per tool. Verify: registry export shows tier. See the blast radius post for the tier definitions. Default failure: untagged tools.

Prompt injection defense (6 controls)

  1. Treat all retrieved content as untrusted. Verify: retrieved chunks are clearly delimited and labeled in the prompt. Default failure: retrieved content concatenated as if it were instruction.
  2. Input filtering for known injection patterns. Verify: known-bad patterns blocked. Default failure: no filter, no detection.
  3. Output validation against schema. Verify: outputs that fail schema are rejected, not passed downstream. Default failure: free-text outputs trusted.
  4. Tool-call validation. Verify: tool args validated against schema before tool fires. Default failure: tool fires on any args.
  5. Out-of-band confirmation for high-risk actions. Verify: actions above a risk threshold require external confirmation (SMS, email). Default failure: agent confirms itself.
  6. Red-team test cases in CI. Verify: a labeled prompt-injection test set runs on every model or prompt change. Default failure: red-team done once, never re-run.

Data access and egress (5 controls)

  1. Per-agent data scope. Verify: agent can read only its scope. Default failure: full DB access.
  2. Outbound destinations allow-listed. Verify: random domain blocked. Default failure: any URL allowed.
  3. Outbound payload size capped. Verify: 100MB POST rejected. Default failure: unbounded payload.
  4. Outbound DLP scan. Verify: fake credit card blocked. Default failure: no outbound DLP.
  5. Per-call destination logged. Verify: replay shows every URL hit. Default failure: error logs only.

Audit logging (5 controls)

  1. One trace per run. Verify: trace ID resolves to a full reasoning path.
  2. Tamper-evident audit chain. Hash-chained entries. Tip hash stored externally. Default failure: writable audit log.
  3. Retention policy enforced. Verify: old traces aged out per policy. Default failure: traces retained forever (cost) or deleted nightly (compliance).
  4. PII redacted before storage. Verify: a sample trace shows no PII. Default failure: full PII in cold storage.
  5. External witness for tip hash. Verify: tip hash anchored to a write-once store or a third party. Default failure: same admin can edit log and tip.

Human-in-the-loop (4 controls)

  1. HIL gate on Tier 3+ actions. Verify: a Tier 4 call requires a human approve. Default failure: silent execution.
  2. Skimmable approval payload. Reasoning trace, proposed action, single clear question. Default failure: a wall of text, no human reads it.
  3. Default behavior on timeout. Verify: timeout fires the safe default, not the proposed action. Default failure: action fires on timeout.
  4. Approval log. Verify: who approved what, when. Default failure: anonymous approvals.

Rollback and kill switch (4 controls)

  1. Kill switch latency. Verify: drill shows kill-to-halt under 30 seconds.
  2. Per-tenant kill. Verify: stopping tenant A's agents does not stop tenant B's.
  3. Compensating actions documented. Verify: every Tier 2+ tool has a documented reversal.
  4. Rollback drill quarterly. Verify: dated drill report. Default failure: kill switch built, never tested.

Model output validation (4 controls)

  1. Schema-typed outputs. Verify: outputs conform to JSON schema. Default failure: free-text downstream.
  2. Refusal on confidence below threshold. Verify: low-confidence outputs escalate, not act. Default failure: act anyway.
  3. Content policy validation. Verify: outputs scanned for policy violations before send. Default failure: unscanned outbound text.
  4. Hallucination check on factual outputs. Verify: cited claims resolved against the source. Default failure: model hallucinates, user trusts.

How to use this checklist

Two passes. First pass: walk every control with the team that owns the agent. For each one, record state as one of pass, fail, or N/A. Time-box to 90 minutes; if a control needs research, mark it as "unverified" and move on. Second pass: triage the fails and unverifieds by blast radius (use the blast radius worksheet) and remediate in that order. Identity, secrets, and tool scoping usually top the priority list; the others compound after those are solid.

Quarterly re-review. Models update, dependencies update, the team rotates. A checklist passed in March can fail in June without any code change because a library shipped a new behavior or a vendor changed an API default. Set a calendar reminder. Pass results into the SOC 2 evidence pack or the equivalent your auditor accepts.

Mapping controls to real incidents

The controls earn their keep against named failure modes. A 2024 advisory on plugin compromise mapped directly to control #11 (Tool scoping per capability) and #45 (Third-party tools sandboxed). Prompt-injection incidents documented across the industry in 2024 and 2025 map to controls #16-21 (Prompt injection defense). Cross-tenant leak incidents map to #1 (Per-agent service identity) and #3 (Per-tenant secret scopes). The pattern: incidents that look novel almost always trace back to a checklist item that was passed quickly or never verified. The cheapest defense is the next-quarter re-audit that re-tests every "verified" control.

Third-party tool trust (3 controls)

  1. Tool provenance recorded. Verify: every registered tool has author, version, hash. Default failure: anonymous tools.
  2. Third-party tools sandboxed. Verify: they cannot read the agent's secrets. Default failure: shared scope.
  3. SBOM and dependency scan. Verify: third-party tools scanned for known CVEs in CI. Default failure: rolling Russian roulette on transitive deps.

FAQ

How many controls should a review cover?
Forty-seven, across ten categories. Each control has an action, a verification step, and a default failure mode.
What is the #1 OWASP LLM risk?
Prompt injection (LLM01). Defense is layered: input filter, output validation, tool scoping, human gates.
What is excessive agency?
OWASP LLM07. Agent permitted more than needed. Defense is least-privilege scoping at the platform layer.
How often should I rotate API keys?
90 days production, 30 days high-privilege. Use short-lived per-run tokens where supported.
How do I make audit logs tamper-evident?
Hash-chain entries; anchor the tip externally. Editing past entries rewrites the chain forward and is detectable.

Mapping the checklist to common compliance frameworks

The 47 controls map cleanly to most security frameworks teams are already audited against. SOC 2 Common Criteria CC6 (Logical Access) covers identity and secrets. CC7 (System Operations) covers audit logging and incident response. ISO 27001 Annex A.9 covers access control; A.12 covers operations security; A.16 covers incident management. NIST 800-53 Rev 5 mapping is direct: AC-2/3/6 (access control) covers identity and scoping; AU-2 through AU-12 covers audit logging; IR-4 through IR-8 covers incident response and rollback. HIPAA Security Rule §164.312 covers technical safeguards for any health-data agent.

Practical advice: do not invent a new evidence pack. Take the controls from this checklist, tag each one with the SOC 2, ISO 27001, and NIST 800-53 sections it maps to, and hand the same artifact to every auditor. The work is done once; the format flexes per audit.

Closing the loop

Forty-seven controls in ten categories. Audit them once, fix the defaults, then re-audit quarterly. The list is short enough to fit on one wiki page and long enough to catch the bugs that get teams in the press. Related: blast radius control, monitoring playbook, and the broader security playbook.

Sources