Appendix D — Security Checklist

Regulated agents fail open when security is “in the prompt.” Use this at design review and before each autonomy expansion.

Trust boundaries

• Untrusted channels listed: user text, ticket notes, retrieval, tool bodies, foreign A2A artifacts
• Instruction hierarchy enforced in code, not only wording
• Tool outputs treated as data, never as authority

Authn / authz

• Distinct identities for API users, workers, and each agent/module
• Least-privilege credentials per MCP server / tool tier
• No long-lived god keys in worker env for all tools
• Authorization checks in executor — independent of the model (Ch 27)

Tools

• Schema validation; fail closed on unknown fields
• Separated read vs write tools
• Dry-run mode for writes
• Approval ticket required for consequential sends
• Idempotency keys on side-effecting calls

Injection & content

• Canary tests for SYSTEM:-style markers in tool output
• Truncation / structuring of hostile HTML/PDF text
• Retrieval corpus integrity controls (who can publish)

Multi-tenant

• Negative tests for cross-tenant read/write (IDOR)
• Per-tenant encryption / audit boundaries as required
• Quotas against noisy-neighbor model spend

Protocols

• MCP does not bypass policy/authz
• A2A only at org boundaries; artifacts land on ledger
• Sampling-in-tool features disabled unless budgeted as nested agents

Audit & privacy

• Evidence pack for consequential actions
• Trace PII redaction policy
• Delete / suppress paths for data-subject requests
• Tamper-evident ledger or WORM store for audit log

Process

• Threat model updated this quarter
• OWASP LLM Top 10 review noted [VERIFY edition]
• Secrets scanning in CI
• Dependency pin + advisories process