# Security for the AI agents you run Every AI agent that can read a mailbox, query a database or call an API is a new door into the company, and it opens for whoever writes the right sentence in front of it. Most companies already have more of these doors than they know of: the assistant somebody connected to their mailbox, the chat tool with a key to the shared drive, the agent a vendor switched on. We map those doors, lock each to what its agent needs, record what passes through them, and test that the locks hold. ## Mapped: every agent and what it can reach You cannot protect a door you have not counted. We list every agent in use — the ones IT approved and the ones staff connected on their own — with the credentials it holds, the tools it can call and the data those reach. The map is a document kept with your configuration and updated when an agent is added, not a slide made once for a meeting, and it is the first thing an auditor, a large customer or an insurer will ask to see. ## Locked: each agent on least privilege An agent gets its own identity and the smallest [privilege](/glossary/#privilege) its job needs: roles rather than shared accounts ([RBAC](/glossary/#rbac)), read-only by default, writes only through narrow tools with limits on how often and how much. [Secrets](/glossary/#secret) are split per agent and per host, never pasted into a prompt, and rotated without a code change. Text an agent reads — an email, a web page, a document — is treated as data, never as instructions, so a message that says "ignore your rules" grants nothing. Controls fail closed: when a check cannot run, the action is refused. ## Recorded: what it did, and for whom Every tool call is [logged](/glossary/#logging) with the person it acted for, what it was asked, what it touched and what came back, and the log is kept where the agent itself cannot change it. [Alerts](/glossary/#alert) fire on the unusual — a burst of reads, a tool used at three in the morning, access to data the agent has never needed. When something does go wrong, the record is what turns an [incident](/glossary/#incident) into a timeline rather than a guess. ## A lock is tested, not trusted A control that has never been tried is a control you hope works. We have found three brute-force protections on one server that had never worked, each one reporting itself healthy, and that is the reason every control we install is proved on every run: the ban is tried against a test address, the rule is read back, the injection is attempted on purpose. When a leak has already happened, we contain it, rotate what it exposed, and write the rule into the repository that stops the same leak twice. ## The work behind it We have done this work on servers, identity systems and platforms. We [wrote 1,000 RBAC rules across Linux and database servers](/portfolio/wrote-1000-rbac-rules-to-secure-linux-servers/), [led access management across M365 and single sign-on](/portfolio/led-access-management-across-m365-and-sso/), and [ran a continuous security scanning programme with 21 written audits](/portfolio/ran-a-continuous-security-scanning-programme/). We [split every operational secret per host](/portfolio/split-every-operational-secret-per-host/), [added a one-second preflight for secrets](/portfolio/added-a-one-second-preflight-for-secrets/), [found three locks on the door, none of them locked](/portfolio/three-locks-on-the-door-none-of-them-locked/), and [proved the intrusion ban works on every run](/portfolio/proved-the-intrusion-ban-works-every-run/). We [built fail-closed rate limiting](/portfolio/built-fail-closed-rate-limiting-and-anti-abuse/) and [wrote a scope rule after a leak](/portfolio/wrote-a-scope-rule-after-a-credential-leak/). How we keep our own house is on [how we work securely](/security/). ## How an engagement runs It starts read-only. We map every agent, its credentials and what they reach, and hand you the findings in order of risk, each with its reason and the fix. The fixes are then made in your configuration and your repository, through your review, with checks that fail when an agent's access grows past its map. You keep the map, the record and the tests — the file you hand to an auditor or an insurer — and the [data agents read](/ai-data/) can be permissioned the same way. It is bought like the rest of our work, on the terms in [what it costs](/what-it-costs/). If agents already hold keys to your systems, [tell us which ones](/contact/) *(we answer the same day)*.