CLLMSP · Domain 5
AI Agent Hardening
About 12% of the exam
Anatomy of an agent
- Goal
- the outcome the agent pursues
- Planner
- decomposes the goal into steps
- Executor
- turns a step into calls
- Tool set
- everything the agent can reach
- Memory
- state carried between turns
- Loop
- observe, plan, act, repeat
- Principal
- the human the action serves
- Autonomy level
- how far without a human
- Kill switch
- operator halt for the fleet
An agent is a loop holding credentials, so every question about agent risk reduces to what that loop can reach and who approved it
The three dials of agency
Functionality
- Tools installed but never actually needed
- One tool doing far too much
- Read and write in one call
- Restrict the tool set per task
Permission
- Credentials broader than the task
- Standing rights instead of just-in-time
- Shared service account hides the principal
- Scope tokens to a single tenant
Autonomy
- Acting without any human checkpoint
- Irreversible steps taken unattended
- No ceiling on repeated actions
- Approve state changes by hand
From plan text to real targets
- Plan steps are prose, not commands
- Delete stale records becomes table-wide delete
- Resolve targets by explicit enumerated identifiers
- Never let phrasing choose the scope
- Dry run and show the diff
- Reject a plan step lacking targets
Memory as an attack surface
- Injected text can persist into memory
- One poisoned note steers later sessions
- Review before anything durable is written
- Scope memory per user and task
- Expire and version stored notes
- Let the principal inspect and delete
Agent identity
- Owner-bound identity
- credential follows the human lifecycle
- Service account
- hides who actually asked
- Delegated token
- carries the caller's own entitlements
- Just-in-time elevation
- rights granted for one task
- Offboarding
- agent access dies with the owner
- Attribution
- every action traced to a person
Deterministic limits
- Ceilings enforced in application code
- Per-transaction and per-day value caps
- Statement timeouts and query cost limits
- Maximum steps before the loop stops
- Token and spend budgets per run
- Change freezes block agent writes
Sandboxing what the agent runs
- Generated code runs in disposable containers
- No host filesystem or credential access
- Egress allowlist for every outbound request
- Network denied unless the task needs it
- Package installation blocked or mirrored internally
- Timeouts and memory caps on execution
- Discard the sandbox after each run
- Never reuse a sandbox across tenants
Sandboxing limits what a successful injection can do next, so treat it as containment rather than as prevention
Multi-agent and delegation risks
- Agent to agent trust
- one agent believes another's output
- Privilege aggregation
- the chain exceeds any single scope
- Injection propagation
- poisoned text passed down the chain
- Duplicate execution
- two workers take the same item
- Loop amplification
- agents trigger each other endlessly
- Lost attribution
- no principal attached to the action
- Shared memory
- one agent writes another's context
- Orchestrator sprawl
- no single enforcement point remains
Human in the loop that works
- Approve the action, not the session
- Show real arguments and blast radius
- Prompt only where risk is genuine
- Approval fatigue turns into rubber stamping
- Record the approver with the action
- Blocking controls get routed around
Concurrency and reversibility
- Lease a queue item before acting
- Idempotency keys collapse duplicate side effects
- Prefer reversible actions where a choice exists
- Soft-delete windows make removals recoverable
- Retries must not repeat the payment
- Checkpoint state so a run resumes
Watching a fleet
- Telemetry collected outside the agent process
- Log successful calls, not only failures
- Alert on divergence from the request
- Track tool-call volume per principal
- Kill switch tested, not just documented
- Redact transcripts before the warehouse
Standing up an agent
- Define goal
- Threat model
- Scope tools
- Bind identity
- Sandbox
- Pilot
- Monitor
- Start read-only and earn write rights
- Separate reading untrusted data from acting
- Guardrail config lives outside the agent
- Pilot on a low-value tenant
- Document who owns the running agent
- Re-review when tools or models change
Glossary
- Excessive agency
- too much function, permission, autonomy
- Confused deputy
- privilege used for the attacker
- Blast radius
- everything a compromised agent reaches
- Just-in-time access
- rights issued only when needed
- Idempotency key
- repeat calls resolve to one
- Lease
- temporary exclusive claim on work
- Kill switch
- operator stop for running agents
- Autonomy level
- steps allowed without human review
Quick rules
- Remove capability rather than forbid it
- Authorize the human behind the agent
- Enumerate targets, never trust a phrase
- Limits belong outside the model
- Log every action, especially successful ones
- Test the kill switch regularly
Reference strip: agency, identity, limits, containment, operations
Agency
- Functionality, permission and autonomy
- Cut the dial that is oversized
- Reversible beats irreversible every time
- Approve calls, never whole sessions
Identity
- Agent credentials follow their owner
- Delegate the caller's own entitlements
- No shared production service account
- Offboarding removes agent access too
Limits
- Value, step and spend ceilings
- Database timeouts and cost caps
- Enforced in code, not prompts
- Freeze windows apply to agents
Containment
- Sandbox generated code every run
- Allowlist egress and block auto-fetch
- Separate reading from acting
- Review writes to durable memory
Operations
- Telemetry outside the agent process
- Successful tool calls are evidence
- Leases and idempotency stop duplicates
- Kill switch tested before needed
Quick exam traps
- Trap: Internal content is trusted because it came from an internal system
- Trap: Removing a tool solves the risk even when users paste results manually
- Trap: A service account shared by every agent is fine because calls are logged
- Trap: Session-wide approval at the start of a run is meaningful human oversight
- Trap: Monitoring failed tool calls is enough to investigate an agent incident
- Trap: An agent that can rewrite its own guardrail configuration is still constrained
- Trap: Autonomy becomes safe once the underlying model is accurate enough
cybercertprep.com · original revision sheet written from the public body of knowledge