Securing AI agents: a control map for tool use, identity and runtime

Why agents raise the stakes

OWASP defines excessive agency as the vulnerability that enables damaging actions in response to unexpected, ambiguous or manipulated model output, whether the cause is a hallucination or a prompt injection. Indirect injection arrives through content the agent reads, such as web pages or files. For the mail assistant, OWASP’s fixes are a read-only extension, a read-only OAuth scope and a human review before each send. None of them is a filter: each limits what the agent can do.

In our AI Security Layers model most of these controls belong to the agent and tool access layer, which limits what agents can reach. Guardrails sit in the runtime guardrails layer, red teaming in the testing and red teaming layer, and logs feed the monitoring and response band across all layers.

The control map

The seven controls and the tool mapping are our analysis. The OWASP column names the risks each control is meant to reduce.

Control	Question it answers	OWASP risks	Tools in this guide
1. Identity and permissions	Who is the agent acting for, and what may it reach?	LLM06	Zenity, Noma Security, Veza, Astrix, Oasis, Google Cloud Agent Gateway
2. Tool and MCP vetting	Are the tools and servers it connects to safe?	LLM03, LLM06	MCP-Scan, Operant AI
3. Gateways and policy engines	Is each tool call checked against a rule outside the model?	LLM06	Agent Governance Toolkit, AgentCore Policy, Google Cloud Agent Gateway, Invariant Guardrails
4. Sandboxes	If the agent runs code, what can that code touch?	LLM06	Strands Box
5. Runtime guardrails	Can an injected instruction be caught as it arrives?	LLM01, LLM06	Meta Llama Protections, Lasso Security, Straiker
6. Detection and response	What did the agent do, and can we stop and reconstruct it?	LLM02, LLM06	Falcon Guardian, Uber ADR, Pillar Security
7. Red teaming	Does the agent hold up against an attacker before release?	LLM01, LLM06	Promptfoo, Straiker, Pillar Security

We include tools from our agent security category, plus guardrail and red teaming tools that document agent features on a page we could open. We compile from public repositories and vendor pages and do not run the products. Several platforms keep their documentation behind a login, so their entries restate the vendor’s own pages: ask each vendor to demonstrate the control. Fact chips link each source and check date; the methodology explains the Coverage Score.

Control 1: identity and permissions

OWASP’s prevention list starts with offering only the extensions an agent needs, with only the functions and downstream permissions each needs. It also says to run actions in the specific user’s context with minimal scopes and to enforce authorization in downstream systems instead of trusting the model.

Zenity builds a live inventory of agents across SaaS, custom and endpoint deployments Source, checked October 21, 2026: zenity.io · 2026-10-21 (opens in a new tab) . It ties enforcement to the identity of the human the agent acts for Source, checked October 21, 2026: zenity.io · 2026-10-21 (opens in a new tab) , and it evaluates each agent's configuration and permissions against policy before deployment Source, checked October 21, 2026: zenity.io · 2026-10-21 (opens in a new tab) . Best for security teams governing agents built in SaaS copilot platforms such as Copilot Studio and Agentforce.

Noma Security, listed under AI-SPM, sets a baseline of allowed agents, MCP servers and skills, approves or blocks tool calls, and scopes policies by user, IdP group or tool sensitivity Source, checked October 21, 2026: noma.security · 2026-10-21 (opens in a new tab) . It also flags misconfigurations such as excessive agency, unsandboxed agents, secrets in agent instructions and unauthenticated access Source, checked October 21, 2026: noma.security · 2026-10-21 (opens in a new tab) . Best for security teams that need to find and govern agents, MCP servers and models across endpoints, SaaS and cloud.

Agent identity products compared

Three products in the directory sell agent identity as their main job, and each starts at a different point in the life of an access grant. Veza starts from standing access: who owns an agent and what it can reach today. Astrix starts from the credential an agent is handed. Oasis starts from the single request, deciding what the agent may do in this session and issuing an identity that lasts only that long. The identity column below is sourced from each tool page; the other two columns are our analysis.

Product and owner	Identity control the vendor documents	Where it acts (our analysis)	Ask the vendor (our analysis)
Veza AI Agent Security, ServiceNow (Veza) Source, checked October 21, 2026: sec.gov · 2026-10-21 (opens in a new tab)	links each AI agent to a human owner and alerts when the owner leaves Source, checked October 21, 2026: veza.com · 2026-10-21 (opens in a new tab)	Standing permissions and ownership, reviewed between runs	Does removing an excess permission happen in Veza, or as a ticket for the team that owns the target system?
Astrix AI Agent Security, Cisco (Astrix Security) Source, checked October 21, 2026: blogs.cisco.com · 2026-10-21 (opens in a new tab)	provisions agents with short-lived credentials and just-in-time, precisely scoped access through the Agent Control Plane Source, checked October 21, 2026: astrix.security · 2026-10-21 (opens in a new tab)	The credential, at the moment it is issued	Will the Agent Control Plane stay available on its own inside Cisco, and on what terms for new buyers?
Oasis Security, Cyera (Oasis Security) Source, checked October 21, 2026: cyera.com · 2026-10-21 (opens in a new tab)	issues ephemeral per-session identities so each agent request runs on a short-lived, least-privilege identity Source, checked October 21, 2026: oasis.security · 2026-10-21 (opens in a new tab)	Each request, with policy decided at run time	How is intent classified, and what does the agent do when the classification is wrong?

Against OWASP’s LLM06 advice, the three go after excessive permissions in two ways. Veza finds and removes standing access an agent should not hold: it reviews and enforces least privilege for AI agents by removing excessive permissions Source, checked October 21, 2026: veza.com · 2026-10-21 (opens in a new tab) . Astrix and Oasis shrink the time a permission exists at all, so a credential stolen from a hijacked agent stops working soon after. Oasis adds a decision on every request, since it reads an agent's intent in real time, applies policies automatically and blocks risky actions before they reach data Source, checked October 21, 2026: oasis.security · 2026-10-21 (opens in a new tab) , and Astrix adds detection after the fact, since it detects and responds to threats such as compromised credentials and out-of-scope agent actions Source, checked October 21, 2026: astrix.security · 2026-10-21 (opens in a new tab) . A team with many long-lived service accounts behind its agents would start with the review; a team building new agents can issue short-lived credentials from day one.

The capabilities we recorded for these three do not include running an agent’s actions in the end user’s own context, OWASP’s other scope advice. Two tools in the directory document tying the agent to the person it acts for: Zenity ties enforcement to the identity of the human the agent acts for Source, checked October 21, 2026: zenity.io · 2026-10-21 (opens in a new tab) , and NeuralTrust forwards the end-user identity through every hop of an agent request Source, checked October 21, 2026: neuraltrust.ai · 2026-10-21 (opens in a new tab) . Google Cloud Agent Gateway and Microsoft’s Agent Governance Toolkit, under control 3, give each agent a cryptographic identity of its own inside their platform or framework.

All three specialists now belong to larger companies. Cisco announced on May 4, 2026 that it intended to acquire Astrix Security; a June 29, 2026 update says it has completed the deal. Cisco plans to integrate Astrix's capabilities into Cisco Identity Intelligence. Source, checked October 21, 2026: blogs.cisco.com · 2026-10-21 (opens in a new tab) The Astrix page also records that standalone sales of new licenses ended on June 30, 2026. Veza is now part of ServiceNow and Oasis part of Cyera, and none of the three tool pages records a published price, so plan for a sales conversation and ask where the product sits in the new owner’s suite.

Control 2: tool and MCP vetting

Scan the MCP servers and skills an agent uses, keep an allow list and block what you have not approved. Our MCP security tools guide covers scanners in depth.

MCP-Scan auto-discovers agent configurations for Claude Code, Cursor, VS Code, GitHub Copilot, Windsurf and Gemini CLI Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It also scans MCP servers, including their tools, prompts and resources Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for developers checking the MCP servers and skills in their coding agents.

Operant AI applies registries, allow and deny lists and access controls to MCP Source, checked October 21, 2026: operant.ai · 2026-10-21 (opens in a new tab) . It also offers an MCP Gateway for enterprise MCP security Source, checked October 21, 2026: operant.ai · 2026-10-21 (opens in a new tab) . Best for platform teams running agents and MCP servers on Kubernetes.

Control 3: gateways and policy engines

OWASP’s prevention list includes complete mediation: authorization enforced in downstream systems, not left to the model. A policy engine does this for tool calls. It sits in code or at a gateway, sees each call before it runs and allows or denies it by rule, so a prompt injection that fools the model still meets a deterministic check.

Microsoft’s Agent Governance Toolkit has a stateless policy engine that checks every agent action before it runs, with policies in YAML, OPA Rego and Cedar Source, checked October 21, 2026: opensource.microsoft.com · 2026-10-21 (opens in a new tab) . It also produces tamper-evident audit evidence for agent actions Source, checked October 21, 2026: microsoft.github.io · 2026-10-21 (opens in a new tab) . Best for teams that want open-source policy checks inside their own agent framework; the tool page lists the frameworks it integrates with.

In Amazon Bedrock AgentCore Policy, a policy engine evaluates policies for every tool call through an associated gateway, enforcing default deny and forbid-wins outside the agent's code Source, checked October 21, 2026: docs.aws.amazon.com · 2026-10-21 (opens in a new tab) . It offers fine-grained permissions by caller identity (OAuth claims or IAM identity) and by tool input values, such as a refund amount limit Source, checked October 21, 2026: docs.aws.amazon.com · 2026-10-21 (opens in a new tab) , and it logs every enforcement decision to CloudWatch, and a LOG_ONLY mode records decisions without blocking requests Source, checked October 21, 2026: docs.aws.amazon.com · 2026-10-21 (opens in a new tab) . Best for AWS teams whose agents already run on Bedrock AgentCore.

Google Cloud Agent Gateway is the entry and exit point for client-to-agent and agent-to-anywhere traffic, including MCP and A2A, and can parse MCP requests to apply tool-based policies Source, checked October 21, 2026: docs.cloud.google.com · 2026-10-21 (opens in a new tab) . It uses Agent Identity, which gives each agent a SPIFFE ID for authentication, access control and auditing, with mTLS and DPoP enforced by Context-Aware Access Source, checked October 21, 2026: docs.cloud.google.com · 2026-10-21 (opens in a new tab) . Best for Google Cloud teams that want agent identity and tool policy enforced at the network edge.

Invariant Guardrails intercepts tool calls and applies rules to them, such as blocking an external email after an inbox is read Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Its core is a rule language with typed variables and Python-style conditions that match messages and chains of tool calls Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . On ownership, Snyk announced on June 24, 2025 that it has acquired Invariant Labs, the company behind Invariant Guardrails. Source, checked October 21, 2026: labs.snyk.io · 2026-10-21 (opens in a new tab) Check maintenance before you depend on it: the tool page shows the latest release July 28, 2025 Source, checked October 21, 2026: pypi.org · 2026-10-21 (opens in a new tab) . Best for teams writing their own rules over chains of tool calls.

Control 4: sandboxes

An agent that writes and runs code, or launches local MCP servers, needs a boundary that holds when every other control fails. The MCP specification tells clients to run server commands in a sandbox with minimal default privileges and restricted file system and network access. The same logic applies to agent code execution.

Strands Box runs agents in an operating system sandbox with file, program and network access set in a box.toml file Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Credentials stay outside the agent: an egress gateway adds configured API credentials or AWS SigV4 signing to permitted requests so the agent never receives the secrets Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for teams that want sandboxing and default-deny policy for agents in one open-source engine. Our MCP security tools guide adds NVIDIA OpenShell and Kubernetes Agent Sandbox.

Control 5: runtime guardrails

Guardrails check what goes into and comes out of the model, and the agent-focused ones check what the agent is about to do. They are probabilistic, so they sit next to permissions and policy, not in place of them. For input and output screening in general, see the best LLM guardrails.

Meta Llama Protections audits agent reasoning for goal hijacking with the LlamaFirewall AlignmentCheck module Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It also detects prompt injections and jailbreaks with the Prompt Guard 2 classifiers Source, checked October 21, 2026: dev.meta.ai · 2026-10-21 (opens in a new tab) . Its license is a Custom license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , so read the terms for each piece you use. Best for teams that want open-weight classifiers and an agent guardrail framework on their own infrastructure.

Lasso Security flags direct and indirect prompt injection in AI gateway traffic Source, checked October 21, 2026: lasso.security · 2026-10-21 (opens in a new tab) . It also enforces security policies inline at the proxy, API or AI gateway layer Source, checked October 21, 2026: lasso.security · 2026-10-21 (opens in a new tab) . Best for teams that route LLM traffic through an AI gateway and want inline blocking without code changes.

Straiker stops direct and indirect prompt injection and agent manipulation Source, checked October 21, 2026: straiker.ai · 2026-10-21 (opens in a new tab) . It also blocks or revokes risky MCP and tool access Source, checked October 21, 2026: straiker.ai · 2026-10-21 (opens in a new tab) . Best for teams running custom or MCP-connected agents that want discovery, testing and runtime blocking from one vendor.

Control 6: detection and response

OWASP lists logging and monitoring of extensions and downstream systems, and rate limiting, as measures that do not prevent excessive agency but limit the damage. The MCP specification’s Tools page says clients should log tool usage for audit. Detection tools go further: they find agents nobody registered, flag sessions that look compromised and give the security team a record to investigate.

CrowdStrike Falcon Guardian connects AI agent behavior to Falcon endpoint telemetry, tracing how prompts lead to processes and system actions Source, checked October 21, 2026: crowdstrike.com · 2026-10-21 (opens in a new tab) . It also ingests AI agent data into CrowdStrike's own SIEM as first-party data Source, checked October 21, 2026: crowdstrike.com · 2026-10-21 (opens in a new tab) . Best for security teams that already run the Falcon platform and want agent activity in the same console.

Uber ADR’s discovery inventories AI apps, CLI agents, IDE extensions, local model runtimes and MCP servers on endpoints and flags unknown surfaces for review Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Its sensor sensor collects user and assistant text, tool calls with arguments and results, and session context from 11 listed coding agents Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for security teams that want open-source detection for coding agents on developer machines.

Pillar Security monitors agent behavior with logging and enforces data privacy for PII, PHI and secrets Source, checked October 21, 2026: pillar.security · 2026-10-21 (opens in a new tab) . It also catalogs agents, models, tools, MCP servers and skills, including shadow AI Source, checked October 21, 2026: pillar.security · 2026-10-21 (opens in a new tab) . Best for security teams that want agent discovery, testing and runtime guardrails with the option to keep data in their own VPC.

Two platforms above add monitoring. Zenity detects runtime threats and blocks unsafe actions in real time Source, checked October 21, 2026: zenity.io · 2026-10-21 (opens in a new tab) . Noma Security judges each agent action in context at runtime and can block it, mask sensitive data, steer the agent, bring in a human or trigger a killswitch Source, checked October 21, 2026: noma.security · 2026-10-21 (opens in a new tab) .

Control 7: red teaming

OWASP’s prompt injection entry recommends regular adversarial testing that treats the model as an untrusted user. For agents, test the tool paths as well as the chat: can the agent be steered into calling a tool it should not, reading data it should not, or chaining harmless steps into a harmful result? Promptfoo’s agent red teaming guide groups agent risks into areas such as unauthorized access and privilege escalation, memory poisoning, multi-stage attack chains and tool and API manipulation. Our guides to open-source AI red teaming tools and AI red teaming platforms go deeper.

Promptfoo scans for jailbreaks among more than 50 vulnerability types Source, checked October 21, 2026: promptfoo.dev · 2026-10-21 (opens in a new tab) , and it runs evals on pull requests through a documented GitHub Action Source, checked October 21, 2026: promptfoo.dev · 2026-10-21 (opens in a new tab) . On ownership, Promptfoo announced on March 9, 2026 that it had agreed to be acquired by OpenAI. OpenAI's developer documentation now says Promptfoo is part of OpenAI; we found no published closing date. Source, checked October 21, 2026: promptfoo.dev · 2026-10-21 (opens in a new tab) Best for developer teams that want one open-source command-line tool for evals and red teaming, locally and in CI.

Two platforms also document agent testing. Straiker continuously red-teams agents across tools, MCP servers and workflows Source, checked October 21, 2026: straiker.ai · 2026-10-21 (opens in a new tab) . Pillar Security runs multi-turn adversarial attacks with attack transcripts and reproduction steps Source, checked October 21, 2026: pillar.security · 2026-10-21 (opens in a new tab) .

Minimum controls checklist

The first six steps follow OWASP’s guidance for excessive agency and prompt injection, step 8 follows the MCP specification, and the rest is our analysis.

1. Offer the agent only the tools it needs, and only the functions of each tool that it needs.
2. Prefer narrow tools to open-ended ones. A tool that writes one kind of file is easier to bound than a general shell.
3. Act in the user’s context with minimal scopes, so the agent never holds more access than the person it works for.
4. Require human approval for high-impact actions, such as sending, deleting, paying or changing permissions.
5. Enforce authorization in downstream systems or a policy engine, not in the model’s judgment.
6. Treat external content as untrusted and keep it apart from instructions. See indirect prompt injection.
7. Vet and pin the MCP servers and skills the agent uses, and re-check them on every update.
8. Run agent code and local servers in a sandbox with minimal file system and network access.
9. Log every tool call to your security team’s tools, and review the log for tools used in unexpected order.
10. Red team the agent before release and on a schedule, including attacks hidden in documents and web pages.

Limits

These limits are our analysis.

• Vendor statements, not measurements. Most platform entries restate the vendor’s own pages. We do not know how well any control works in your environment.
• Approval is only as good as the screen. A human approval step helps only if the client shows the full tool input before the call.
• Policy engines need policies. A default-deny engine with a permissive rule set enforces nothing useful, so review the rules like code.

Posture and discovery across cloud AI services is covered in what is AI-SPM.