VSO Start with three trust boundaries
AI agent security covers external inputs, tool access, credentials and destination APIs as well as model output. Signing a log does not by itself prevent an inappropriate action.
- Input: treat instructions in retrieved pages, documents and tool responses as untrusted content, not user approval.
- Execution: check the operation, target and authority at the tool or receiving service. A prompt is not an access-control boundary.
- Evidence: distinguish what was observed, submitted or unavailable. A valid signature does not establish capture of every action.
Separate risk, preventive controls and evidence
| Risk | Example control | Evidence and limitation |
|---|---|---|
| Excessive permissions | Limit operations and targets; separate read and write access. | Actor, delegator, policy version and changes. A configuration alone does not prove enforcement on every path. |
| Prompt injection | Treat external content as untrusted and minimize exposure of secrets and powerful tools. | Input references, proposed action and deny/approve decisions. A denial record is not a complete resistance evaluation. |
| Changed arguments after approval | Bind approval to the specific action and expiry; check again at execution. | Approved and executed request correspondence. An agent claiming approval is not approval evidence. |
| Bypassing the recorder | Review credentials, network routes and OS permissions that enable direct API calls. | Allowed-path and denied direct-call tests. Untested alternate routes remain outside the claim. |
| Timeouts and duplicate effects | Check the destination's status-query and deduplication mechanisms before retrying. | Attempt IDs and send, acceptance and outcome records. No response means the result may be unknown. |
This is an explanatory VSO checklist, not a complete threat model or production security assessment.
What to check in an MCP connection
MCP connects tools; connection alone does not establish their safety. Consult the official MCP security guidance, version 2025-11-25, for the transport and authorization model you deploy.
- Validate token audience; do not accept tokens issued for a different service.
- Do not substitute a session ID for authentication. Authorization-enabled servers verify inbound requests.
- Request minimal scopes and check per-client consent for proxy flows.
- Treat local servers as executable code; restrict process, filesystem and network access.
This guide does not claim MCP implementation support or certification for a VSO product.
Example: an unknown CRM update outcome
This is a synthetic illustration, not an executed test result. An agent proposes an address update to a customer record; a reviewer approves the target and new value.
- Persist a pre-action record linking actor, approval, target and arguments.
- If the agreed failure policy requires it, do not send when that record cannot be persisted. First agree which business operation may be stopped.
- If the response is lost after sending, retain an unknown outcome rather than asserting success or failure.
- Reconcile with the destination's status or acceptance record. Link any retry to the original attempt and confirm the API's deduplication conditions.
Designing this flow does not prove that operations outside the gate are blocked. See the AI agent audit log guide for record-level examples.
Prepare an evaluation checklist
- Name the operation, systems, time window, excluded paths and environment owner.
- Describe credential and permission scope without submitting secret keys or token values.
- Identify approval, request, acceptance, outcome and retry separately.
- Test recording failure, denial, timeout and direct API calls in an authorized mock environment.
- Report cryptographic integrity separately from scope sufficiency, including failed and unknown checks.
- Record assistance, executor, environment differences and publication permissions separately.
Minimize sensitive prompts, personal data and credentials in both logs and support requests. Decide which fields to retain, where references point, who may read them and how long they are kept.
Status and limitations
This explanatory guide adds no normative requirements or product guarantees. Experimental extensions remain unadopted; independent third-party reproduction has not been established. First-party CI and synthetic tests are distinct from an independent fresh execution or production suitability.
Related resources
- AI audit trail examples and verification
- AI governance: responsibilities and evidence
- OWASP GenAI Security Project: LLM security overview
- NIST AI Risk Management Framework
External references checked 8 November 2026. VSO explanations and examples do not imply endorsement or adoption by those sources.
Discuss one operation
Describe the operation, current permissions, available records and the question you cannot answer. The initial inquiry does not need secrets or raw logs.
Contact VSO