BonrockYour AI Agents Need Their Own Keys
AI agents inherit whatever access you forgot to scope. How to give each agent its own identity, keep secrets out of its reach and decide what company data it should keep.
An agent that writes and deploys a web function needs an execution identity. Before letting it run, decide which records that identity can read, which services it can call and how much it can spend.
A shared service account with broad rights gets a demo working quickly. It also lets one compromised agent reach everything the account can reach. Separate identities make access easier to restrict and actions easier to trace.
Retrieval must keep the document permissions
Access-control mistakes become especially costly when an agent can chain many operations together.
The classic example is a company search assistant. Someone builds an index of internal documents using an administrator account, so the index contains everything. The assistant then answers any employee's question from that index, and a junior analyst can ask what the executive team is paid. The document permissions existed in the file system; the indexing step quietly flattened them.
In a multi-tenant application, carry the tenant identity through retrieval, tool calls and writes. Add tests that attempt cross-tenant access through each supported route. Tests cover the cases you wrote; code review and monitoring still need to look for gaps.
Give each agent a limited identity
Give deployed functions separate roles with a permissions boundary that limits what those roles can receive. Test an explicit denied action, such as reading another tenant’s storage. Per-function request, concurrency and spend limits reduce the damage from a loop; shared dependencies still need their own protection.
Secrets get the same treatment. Agents write code, and code ends up in logs, repositories and chat transcripts. So the design keeps API keys out of the agent's code entirely: the function calls a small proxy that attaches the key on the way out, and the agent never sees the value it is using. Company data reaches the function through a mediated path that checks whose data it is before handing anything over.
The access checks need to hold even when the agent misreads a request. A separate identity lets you revoke one workflow without disabling every service that shares an account.
Documents Can Carry Instructions
An agent reading email, support tickets or uploaded files will encounter instructions written by people outside your organization. Some may be attempts to redirect its work. A PDF can contain a line in white type telling the assistant to forward the file to an outside address. OWASP’s 2025 list places prompt injection first and recommends layered controls to reduce its impact.
Treat retrieved text as untrusted input. A prompt asking the model to ignore embedded instructions is only one layer. Enforce tool permissions outside the model, so a summarising job has no email tool to misuse. Require approval for external disclosure, spending and permission changes, with the exact recipient, amount or change visible to the reviewer.
Privacy Is Mostly About What You Keep
Shared team agents can make useful work visible, but they also broaden the audience for mistakes. A shared conversation should retain the access boundaries of the underlying documents. The same answer may be appropriate for one channel and confidential in another.
Before recording meetings, identify what personal and confidential information they may contain, the purpose of collection and the consent or other authority required. Decide who can access recordings and when they expire. These are design requirements to check with the organization’s privacy lead for its jurisdiction.
Mask unnecessary sensitive fields before indexing. Remove deleted material from live indexes and caches, and document how backup expiry and restores handle deletion. Check provider terms, retention settings and processing locations against the client’s requirements; a no-training promise alone does not settle those questions.
Test a denied action
Procurement reviewers need evidence of the controls. Log security-relevant actions with the actor, tenant, tool, outcome and time, while keeping secrets and unnecessary personal data out of the log. Test alerts and access revocation as well as successful requests.
Before connecting an agent to company data, ask for its allowed-action list and a redacted sample of recent actions. Then choose one action it must be unable to perform and watch the denial happen. A log documents behaviour; a denial test checks the boundary.
Found this helpful? Pass it on.
Working on something like this?
We help organizations build AI systems that are secure, private and ready for real load.