AI Control Library / CF-12: Security & Abuse Resistance
Designation: Core | Control types represented: Operational and Technical
Control requirement
Restrict agent access through task-scoped identities, narrowly permitted tools and independently enforced resource authorization. Prevent agents from increasing their own permissions or inheriting excessive user authority.
Why this matters
An agent can transform a malicious instruction into a real action when connected credentials are overpowered. The effective permission boundary must remain enforceable despite model mistakes.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to single and multi-agent systems, including background jobs, delegated tools and user-authorized integrations.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The agent owner justifies capabilities; security approves access boundaries; tool owners enforce authorization.
Implementation guidance
- List necessary tools, data and actions for each agent role.
- Issue short-lived credentials bound to task and user context.
- Deny permission changes and unsupported delegation.
- Test malicious instructions and indirect routes to privileged actions.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Unapproved tool invocation | Service refuses execution. |
| Child agent request | Authority cannot exceed the parent allocation. |
| Permission escalation attempt | Independent policy blocks the change. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Agent access inventory
- Scoped token configuration
- Permission tests
- Exception approvals
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Disable affected tools, revoke agent credentials and trace any actions already performed beyond approved scope.
Example in practice
Hypothetical example: A support agent can view order status but cannot change delivery addresses. A message asking it to reroute an order cannot bypass the order service’s permission check.
Related controls
- CF12-002: AI System Least Privilege Access Control
- CF14-001: Agentic System Security Boundaries
- CF14-011: Excessive Agency Prevention
Framework mappings
- CSA AICM (IAM-19)
- NIST AI RMF (MAP 1.1)
- ISO 42001 (Cl. 8.2)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Security & Abuse Resistance
Version 1.0