---
name: lac-agentic-ai-security-review
description: Review AI agents, tool-connected assistants, RAG and autonomous workflows for injection, excessive agency, data disclosure and incident containment before release.
---
# Agentic AI Security Review

**Author and framework lead:** Adrian Dunkley  
**Affiliation:** President, Caribbean AI Association  
**Project:** LAC AI Playbook / Safety & Alignment Toolkit

## Objective

Identify what an AI agent can read, decide, send and change. Determine whether untrusted inputs can cross a trust boundary or cause actions beyond the user's authorization. Report actionable controls and retest evidence.

## Required inputs

Agent diagram; model and prompt versions; permission and connector scopes; retrieval/data sources; API endpoints and secrets handling; confirmation gates; allowed actions; affected people; logging; fallback; threat model; test environment.

## Controlled review

1. **Map trust boundaries.** Label system instructions, user messages, documents, websites, search results, email, tool responses and external APIs. Mark any content the model can encounter that is not a trusted instruction.
2. **Inventory permissions.** For every tool, document read/write/delete/send scope, third-party ownership, token validity, network destinations and whether actions are reversible. Prefer least privilege.
3. **Test injection containment.** In an authorized sandbox, place harmless instruction-looking text inside a retrieved document and verify the agent ignores it as instructions. Record whether tool calls, data access or final answers deviate from approved behavior. Do not attempt unauthorized access.
4. **Test high-impact actions.** Verify approvals for payments, external communications, policy changes, data deletion, record edits and account changes. Require enforcement in code or policy at the tool boundary, not only a prompt request.
5. **Test isolation and failure.** Use synthetic data to check cross-user access, logging of decisions, safe defaults during tool failure, token expiry, rate limits and emergency stop.
6. **Report issues.** Give each finding an impact (1–5), exposure (1–5), existing control (0–4), concrete evidence reference, next step and remediation owner. Put results into the [Safety & Alignment assessment](/safety-alignment).
7. **Decide on release.** A high-impact action without tested authorization and human control must remain on hold even if the aggregate score is low.

## Outputs

Asset and permission register; threat scenarios; test cases and evidence; blocked/allowed action matrix; prioritized risk register; stop/rollback plan; remediation owners. Distinguish *design review* from *tested evidence*. State the date and exact configuration.

## Sources

OWASP GenAI Security (https://genai.owasp.org/); NIST AI RMF (https://www.nist.gov/itl/ai-risk-management-framework).

**Attribution:** Adrian Dunkley, President, Caribbean AI Association. Sole named author of this skill.