The question Teams searching for best practices on LLM access controls and monitoring usually already have a model deployed and already have tools wired to it. The question is not whether to add controls. It is where the control goes, and what you log so that the control can be trusted. This artic
The question Teams searching for best practices on LLM access controls and monitoring usually already have a model deployed and already have tools wired to it. The question is not whether to add controls. It is where the control goes, and what you log so that the control can be trusted. This article answers that question from the attack side. Not because attacks are exotic, but because the failure modes tell you exactly where the boundary has to sit. AI agent security is the practice of constraining what an autonomous or semi autonomous system can do with the tools it has been given, and observing what it actually did. Two halves, and they are not optional halves of each other: Enforcement. Which tool calls are permitted, for which agent, against which resource, under which conditions. Observation. A durable record of what was attempted and what succeeded, sufficient to reconstruct an incident. A system with enforcement but no observation cannot be audited. A system with observation but no enforcement is a very well documented breach. The interesting failures are not prompt injection in the abstract. They are the ordinary consequences of a tool that is reachable and under scoped. Consider a retrieval tool. It takes a tenant identifier and a query. The agent is deployed for tenant A. A user of tenant A crafts input that causes the agent to call the tool with tenant B as the identifier. The model has no concept of tenancy. The tool accepts the parameter it was given. The call returns tenant B data. Nothing in that chain is a sophisticated exploit. There is no jailbreak, no model weights exfiltration, no novel technique. There is a parameter, a tool that trusts it, and no check between them. The same shape repeats across tool types: A write tool that accepts a resource path, where the path is model supplied. A shell or code execution tool whose scope is the process it runs in rather than the task it was invoked for. A credential bearing tool that is available to every agent in the deployment because scoping it per agent was deferred. In each case the root cause is identical. The authorization decision was made once, at deployment time, and never re evaluated at call time. It is tempting to put the restriction in the system prompt. Do not access other tenants. Only use tools relevant to the task. This is not a control. It is a suggestion to a probabilistic system. It may hold for a thousand calls and fail on the thousand and first, and you will have no signal that the boundary moved. Access control has to be deterministic. That means it cannot live in the component whose behavior is the thing you are trying to bound. The check belongs at the tool boundary, in the request path between the agent and the tool implementation, evaluated per call. Ordering matters: The agent emits a tool call with arguments. The call is intercepted before the tool executes. The caller identity, the tool identity, and the arguments are evaluated against policy. The decision is recorded. Only then does the tool run, or the call is rejected. Step 3 is the whole point. The arguments are part of the authorization input, not just the caller. A tool call to read_document is not inherently permitted or denied. It depends on which document, for which agent, on whose behalf. Step 4 is what makes step 3 auditable. If the decision is not recorded alongside the arguments, you cannot later answer whether the boundary held. This is also why per session authorization is insufficient. An agent session can span many tasks and many resources. A session scoped grant is a grant to everything the session will ever touch. An agent is given a summarization task and a retrieval tool. The tool was scoped at deployment to the production document store, because that is where the documents are. A second agent, for a different team, is given the same tool because the tool registry is shared and scoping per agent was on the roadmap. The second agent is prompted, by a user with legitimate access to that agent, into retrieving documents the user is not entitled to see. The retrieval succeeds. The summarization succeeds. The output is returned. No alarm fires, because there was no per call policy to violate and no per call log to inspect. The incident is discovered when someone notices the content, not when the system notices the call. Three properties, in order of importance: Least privilege per agent, not per deployment. Each agent gets the narrowest tool set and the narrowest argument scope that its task requires. If an agent does not need a write tool, it does not have one. Authorization at call time, with arguments in scope. The policy evaluates caller, tool, and arguments together. A tool call is a request, not a standing permission. Per call logging with enough context to revoke. Record the agent identity, the tool, the arguments, the decision, and the outcome. If you cannot name what an agent touched, you cannot confidently revoke it. reskSecure provides the enforcement point at the tool boundary. Policy is evaluated per call with the arguments in scope, so a retrieval call is authorized against the specific resource it names rather than against the tool in general. Denials and permits are recorded as they are decided. ReskPoints provides the observation side. Tool calls and their outcomes are captured so that the question which agent touched which resource has an answer that does not depend on reconstructing logs by hand. Together they cover the two halves described above: enforcement that is deterministic because it sits outside the model, and observation that is complete enough to act on. Enforce least privilege on your agents: https://resk.fr/projects/resksecure.html For the related question of how tool permissions should be structured per agent, see AI agent tool permissions. Every tool call is intercepted before the tool executes. Authorization evaluates caller, tool, and arguments together. Authorization is evaluated per call, not per session and not at deployment. Each agent holds the narrowest tool set its task requires. Argument scope is constrained, not just tool availability. Every decision, permit and deny, is logged with its arguments. Logs are sufficient to answer which agent touched which resource. Revocation is possible without reconstructing state from raw logs. No authorization decision depends on the model following an instruction.
Key Takeaways #
- •The question Teams searching for best practices on LLM access controls and monitoring usually already have a model deployed and already have tools wired to it
- •This story was reported by Dev.to , covering developments in thedev space.
- •AI advancements continue to reshape industries — read the full article on Dev.to for complete coverage.
📖 Continue reading the full article: