The CISO checklist for AI agent security

Eleven questions, each linked to the controls and categories it tests.

1. 1. Inventory

   Can it discover every agent, MCP server, and skill, and the credential behind each, including shadow agents in SaaS copilots and coding agents?

   Agent as a first-class identityAgent discovery and AI postureAgent identity and credentials

2. 2. Agent identity

   Is each agent a first-class identity with an owner, or a borrowed service account or static API key?

   Agent as a first-class identityShort-lived, secretless credentialsAgent identity and credentials

3. 3. Delegation

   Does it support RFC 8693 token exchange, Cross App Access, and CIBA approval, and does it keep the user-plus-agent chain across multi-hop calls?

   On-behalf-of token exchangeCross App Access (ID-JAG)Asynchronous human approval (CIBA)Delegated and user-to-agent auth

4. 4. MCP OAuth conformance

   Does it implement protected resource metadata, PKCE, and resource indicators, prefer client ID metadata documents over dynamic registration, and block token passthrough?

   MCP authorization conformanceMCP and AI gatewaysDelegated and user-to-agent auth

5. 5. Least privilege

   Are scopes set per tool, are tokens just in time and short lived, and is authorization re-evaluated continuously instead of granted once?

   Fine-grained authorizationShort-lived, secretless credentialsAgent authorization and fine-grained policy

6. 6. Token sprawl

   Is there a vault or broker so secrets and third-party tokens never reach the model?

   Token vaultDelegated and user-to-agent authAgent identity and credentials

7. 7. Kill switch

   Can you revoke one agent, one tool, or every token an agent holds, in seconds, across vendors?

   Kill switchAgent detection, response, and auditAgent identity and credentials

8. 8. Audit trail

   Is every tool call logged with human, agent, tool, data, and decision, exportable to your SIEM and usable as EU AI Act and ISO 42001 evidence?

   Per-action audit chainAgent detection, response, and auditAI governance and GRC

9. 9. Data protection

   Is retrieval permission-aware, is oversharing detected, is output inspected for sensitive data, and does data classification feed agent policy?

   Fine-grained authorizationAI data security and DLP

10. 10. Runtime defense

    Does it catch indirect prompt injection and intent drift, and what latency does it add to each call?

    Runtime guardrails and AI firewalls

11. 11. Consolidation risk

    Is the vendor independent or recently acquired, and what happened to its roadmap and open source after the deal?