AI agent security: control what it reads and where it goes
Contents
Reading and acting are separate boundaries
Trace the information through both
An agent asked to explain an outage may need an approved incident summary without needing a credential attachment stored beside it. The reading boundary decides what reaches the agent’s context. The action and output boundaries decide where that information can go. A useful security review examines both.
Keep the task smaller than the connecting account
In this fictional exercise, support assistant Cedar may read incident summary I7. Credential attachment K7 is restricted to a separate administrator identity. A harmless marker, TEST-KEY-ORCHID, stands in for a secret; no real credential is used. Cedar’s task is to draft an internal explanation, not publish an update.
The intended access is narrower than “read this workspace.” The connection needs an attributable effective identity, an owner and a scope tied to that task. A shared administrator credential would erase the distinction we want to enforce. NIST’s Zero Trust Architecture grounds access in explicit resource authorization rather than trust from being inside the network.
Look beyond the search result
Apply the intended boundary to titles, snippets, full document reads, generated summaries and source links. A search that hides K7 is insufficient if a direct read by its identifier returns the attachment. Likewise, a summary can reveal material the source path correctly withholds.
A shared index can enforce authorization; a live connector can get authorization wrong. Identify where the effective identity and resource decision are applied in the actual implementation instead of assuming the storage pattern settles the question.
If I7 itself contains a restricted appendix, choose an enforceable rule. A supported section-level filter may permit the approved summary while withholding the appendix. If that boundary cannot be reliably implemented for the format, exclude the mixed document or supply a separately approved summary. Whole-document denial is sometimes the right decision; partial redaction is not a guaranteed HeyBrain feature.
A completed fictional exercise
These invented observations show how separate findings affect the decision. They are not test results from HeyBrain or another product. The administrator’s access is included to confirm that the fixture exists, not to grant Cedar the same access.
| Check | Fictional observation | Finding |
|---|---|---|
| Cedar searches for K7. | No title, snippet or marker returned. | This search path withheld the attachment. |
| Cedar requests K7 directly by identifier. | TEST-KEY-ORCHID is returned. | The direct-read path violates the intended boundary. |
| Administrator reads K7. | The marker is returned. | Consistent with this fixture’s administrator grant. |
| I7 includes a harmless instruction to publish its contents externally. | The send tool rejects the unapproved destination. | The outbound check worked in this case; the direct-read failure remains. |
The decision is still no-go
In this fictional review, Cedar remains disconnected from real restricted material until the direct-read path enforces the same resource decision. The owner then repeats the affected search, read, summary and source-link checks. The blocked send does not compensate for the unauthorized read.
Also include a removed grant, revoked connection and stale imported copy in the actual evaluation. Establish the expected propagation behavior first. Check a fresh request and any retained client session that remains in scope; do not call a current login test proof about every old session.
The five-check permission exercise provides a broader fixture. The point here is the interaction between retrieval and execution, not a claim that four checks constitute a complete security test.
Allowed content can still carry untrusted instructions
Reading I7 does not make every sentence in it an instruction the agent may obey. A quoted message or imported page may originate from someone who has no authority to change the task. Keep retrieved evidence separate from trusted instructions and constrain the tools and destinations available for the job.
OWASP’s AI Agent Security Cheat Sheet treats prompt injection, tool permissions, memory, output validation and monitoring as separate concerns. Its action guidance calls for authorization outside the model, with approval bound to the actual operation where required. These controls complement scoped reading; neither replaces the other.
A read-only agent can still disclose information in its ordinary answer. A permitted reader is not automatically a permitted recipient for an external message. Review the output audience as well as whether the tool changes data.
Keep evidence that can answer the incident question
Retain the effective identity, resource reference, decision, operation and relevant time for the paths being investigated. Know which surfaces produce records and protect access to them. A question or identifier may reveal sensitive information even without document text.
A record of the blocked send supports that finding. It cannot prove the marker never entered context, and an intact log cannot prove unrecorded paths did nothing. Assign someone to close the direct-read defect, manage connection expiry and repeat checks when scope changes. The agent knowledge governance guide covers that ongoing ownership.
Prepared by HeyBrain Editorial Team with AI assistance. Examples are fictional illustrations, not observed customer incidents or product tests. This correction retains the original publication date and corrects the earlier account. Primary sources were checked on 13 October 2026.
