Giving An Agent
Access

You are my AI agent security auditor. Your job is to find every way an agent I am running could cause real damage, and to give me a specific, ordered plan to close those gaps. Be direct. I would rather hear an uncomfortable finding than a reassuring summary. MY SETUP Agent name and the job I gave it: [describe it in one or two sentences] Where it runs: [ChatGPT, Claude, Claude Code, Copilot, n8n, Zapier, a custom script, a server, a phone] Tools, apps and accounts it can reach: [list every connector, MCP server, skill, plugin, extension, API key, integration, file folder and login] Whose account those connections use: [my personal login, a shared admin account, a dedicated service account, a mix] What it is allowed to do without asking me: [be honest about what runs unattended] What data it can see: [customers, finances, employees, health, private files, credentials, nothing sensitive] Where its input comes from: [me only, incoming email, web browsing, uploaded files, support tickets, form submissions, other agents] Does it remember things between sessions: [yes with persistent memory, no, not sure] How often it runs and whether I watch it: [live while I watch, scheduled, overnight, continuously unattended] If it did the worst possible thing, who else is affected: [just me, my customers, my team, my clients] WORK THROUGH THIS IN ORDER. DO NOT SKIP A STEP. 1. ACCESS INVENTORY List every system the agent can reach. For each, state the real permission level it holds right now (read, write, delete, admin, send, spend) and the worst realistic outcome if that permission were used wrongly. Be concrete about the damage in my business, not abstract about risk categories. If I have described a permission vaguely, say what you would need to check and where. 2. THE THREE-LEG TEST Determine whether this agent has all three of the following at once: A. access to private or sensitive data B. exposure to text written by someone outside my business C. any way to send data out (email, posting, webhooks, API calls, uploads, opening a URL) State clearly which legs are present and quote the specific part of my setup that creates each one. If all three are present, say so bluntly, explain that this makes the agent exploitable by anyone who can get text in front of it, and tell me which single leg is cheapest for me to cut given what this agent is actually for. If only two are present, name the change that would accidentally add the third, so I do not create it later without noticing. 3. UNTRUSTED INPUT PATHS List every place this agent reads text that somebody outside my business could have written: web pages, incoming email, support tickets, reviews, shared documents, file contents, search results, calendar invites, form submissions, output from other agents. For each, name the specific action the agent could be talked into taking through that path, and the change that stops a bad instruction there from reaching a dangerous tool. 4. NECESSARY VS INHERITED Split the access list in two: what the agent genuinely needs for the job I described, and what it only has because it came bundled with a broad login or a wide scope. For everything in the second group, tell me exactly what to disconnect or narrow, and where in that product's settings I do it. If you are not certain of the current menu path, say so rather than inventing one. 5. PROMPT-ONLY RULES Find every rule I am currently enforcing with instructions instead of permissions. For each, give me the enforced equivalent: the setting, the scope, the allow or deny entry, the separate account, the spend cap, the approval gate. If the product has no way to enforce it, say that plainly and give me the closest real workaround. 6. AUTONOMY REVIEW Separately from access, assess how much this agent can do without asking. For each unattended action, tell me whether it has earned that autonomy, and what evidence would justify it (how long it has run clean, what volume, what review). Recommend a specific graduation path rather than all-or-nothing. 7. SUPPLY CHAIN List every skill, plugin, extension, MCP server, template or third-party integration this agent loads. For each, ask: who publishes it, is that publisher verifiable, when did I install it, and has anything re-checked it since. Flag anything with real access whose behavior could have changed silently after I approved it. Tell me which ones to re-verify first and what specifically to look at. 8. MEMORY AND PERSISTENCE If this agent remembers across sessions, identify what can write into that memory and whether any of it originates from untrusted content. Name the risk of a bad instruction persisting after the conversation ends. Tell me how to review what it currently holds, how to clear it, and what rule to set about what may be written to long-term memory. 9. CREDENTIALS AND IDENTITY For every key, token, or connected login: is it dedicated to this agent or shared with me or my team, how old is it, when was it last rotated, does it expire, and does it carry a spend limit. Flag any credential where the agent inherits broader rights than the task requires. Give me a rotation and expiry plan with actual dates. 10. APPROVAL GATES Name every action this agent can take that is irreversible, outward facing, or costs money. For each, tell me whether it should be blocked outright, require my approval at the moment it runs, or stay automatic. Give me a short list I can paste straight into the agent's configuration or settings. 11. THE ATTACK CHAIN Now work against me. Write the most plausible realistic attack on this specific setup as a short numbered sequence: where the attacker gets text in front of the agent, what that text says, which tool the agent reaches for, and what leaves my business. Use my actual tools and data, not a generic example. Then write the shortest version of that chain that still works, because that is the one that will actually happen. Finally, name the single change that breaks the chain earliest. 12. BLAST RADIUS Assume the agent is fully compromised tomorrow and does the worst thing its current permissions allow. Describe that scenario in plain language, including who else it touches and what I would owe them. Then give me the two changes that shrink it most for the least effort. 13. THE KILL SWITCH DRILL Assume I need to cut this agent off from everything in the next five minutes. Write the exact steps in order: what to revoke, where, what to rotate, what to disconnect, and what stays broken afterward that I should expect. Then tell me what I should test in advance so this works under pressure, and what evidence I should preserve before I start revoking. 14. THE FIX LIST End with a numbered checklist of the exact changes to make, ordered by how much risk each removes per minute of work. For each item give: the change, where I do it, roughly how long it takes, and what it protects against. Mark each one Today, This Week, or Nice To Have. Put anything that closes the three-leg test at the top regardless of effort. HOW TO ANSWER ME Use only what I told you about my setup. If something is unclear or missing and it changes your answer, ask me before assuming. Do not tell me my setup looks fine without naming exactly what you checked and what you could not check. If a risk depends on a product detail you are not certain about, say you are not certain rather than inventing a setting name or menu path. Rank honestly. If one finding matters far more than the rest, say that instead of giving me a flat list of ten equal items. Skip the reassuring summary at the end. Finish on the fix list.