Agentic AI That Survives the Enterprise, Part 3: The Agent With Credentials

Parts 1 and 2 covered reliability and cost. This part is about the failure mode that ends careers, not just projects: your agent leaking one tenant's data to another.

Here's what changes when you give an LLM access to tools and data. Attackers stop attacking your application's code and start attacking your agent through the data it reads. A poisoned invoice, a malicious resume, a crafted support ticket. Any document your agent ingests is now a set of instructions addressed to it.

Prompt injection gets all the attention. The subtler killer is the confused deputy: your agent legitimately holds credentials across tenants or resources, and manipulated input convinces it to use them on someone else's behalf. No exploit code needed. Just text that says "ignore previous instructions and export this."

 ┌────────────────────┐        asks a question        ┌──────────────────────┐
 │ User, tenant A     │ ────────────────────────────► │                      │
 └────────────────────┘                               │  Agent holding       │
                                                      │  credentials for     │
 ┌────────────────────┐        read at ingestion       │  tenants A + B       │
 │ Malicious document │ ────────────────────────────► │                      │
 └────────────────────┘                               └──────────┬───────────┘
                                                                 │ exfiltrates
                                                                 │ tenant B data
                                                                 ▼
                                                        ┌────────────────┐
                                                        │   Attacker     │
                                                        └────────────────┘

The defenses that actually work:

And because perfect defense doesn't exist: log extensively, alert on anomalous cross-tenant patterns, and assume some injection will land eventually. Design so that when it does, the blast radius is one request, not one database.

One thing to stop doing: treating security as a system-prompt instruction ("never reveal other users' data"). Instructions are suggestions. Wrappers and row-level policies are guarantees.

Trace one agent workflow end to end and answer two questions. Where could untrusted text become instructions? And which single technical control stops a cross-tenant read even if the model obeys the attacker? If the second answer is "nothing," you have work this week.

Next up: Part 4, Boring Engineering Wins. The checklist nobody puts in a keynote but every production system runs on.