Agent Security Architecture

The situation

Once an agent can read private data, call external APIs, and receive input from third parties through emails, documents, and transcripts, the agent itself becomes the exfiltration path. Most enterprise AI guidance stops at single sign-on. This agent needed controls that assume the prompt will be attacked.

What I built

I started with a tool matrix: every one of the 84 tools classified by which risk legs it touches, with per-tool mitigations and the residual risk written down. Then the runtime controls. An action firewall intercepts side-effecting calls and applies policy before they execute. A taint graph tracks which arguments to an outbound call originated from untrusted input, so "this email was sent because a tainted document said so" is mechanically detectable rather than a forensic guess.

At the network layer, Azure Firewall enforces a deny-by-default allowlist of 21 fully qualified domains, managed in code. The system prompt and tool registry are root-owned, read-only, and SHA-256 hash-pinned at build and verified on every start, so the agent cannot rewrite its own instructions. All output streams to a logging backend the agent has no credentials to read or modify.

The outcome

Five layers documented and enforced in production. The security review became a walk through the matrix rather than a debate about whether agents can be safe.

Stack