Agentic AI security is a credential problem, not a prompting problem

An AI agent that can write to your CRM, ERP or database is a production actor. The interesting failures are not jailbreaks — they are ordinary, successful API calls made for the wrong reason, with no diff, no evidence and no signature behind them.

This page is the threat model we build against, the seven controls that actually reduce blast radius, and the anti-patterns we see most often. The through-line: keep the write credential out of the reasoning system.

[ 01 / 03 ] · THREAT MODEL // what actually goes wrong //
T1

Indirect prompt injection

Untrusted text in an email, ticket or web page instructs the agent. The model complies, and the instruction reaches your record layer as an ordinary API call.

MITIGATION → HUMAN GATE ON WRITE
T2

Over-broad credentials

An admin token issued once for convenience. Every later task inherits the full blast radius, including tasks nobody scoped for it.

MITIGATION → AGENT HOLDS NO WRITE TOKEN
T3

Silent misinterpretation

No failure, no exception. The agent read "end of Q3" and picked the wrong fiscal calendar. Correct syntax, wrong fact.

MITIGATION → EVIDENCE REQUIRED PER FIELD
T4

Unbounded batch actions

One reasoning step produces four hundred updates. The intent was plausible; the volume is the incident.

MITIGATION → RATE + SCOPE POLICY
T5

Non-repudiation gap

After the fact there is no diff, no reason, no signature — so nobody can say who changed the record, or on what basis.

MITIGATION → HASH-CHAINED AUDIT TRAIL
T6

Time-of-check / time-of-use

A change approved on Monday merges on Wednesday, against a record that moved in between — or became immutable.

MITIGATION → RE-EVALUATE AT MERGE TIME
[ 02 / 03 ] · CONTROLS // seven that hold //
C1

Separate the proposer from the writer

The component that reasons must not be the component that commits. An agent emits a change set; a narrow merge worker — the only holder of the write credential — applies approved changes. Injection then buys the attacker a proposal, not a fact.

C2

Least privilege, per system of record

Read-only tokens on the read path. One scoped write credential per system, held by the merge worker, never by the model, the console session, or a developer laptop.

C3

Policy as deterministic code

Do not ask a model to enforce its own guardrails. Field-level rules, schema validation, immutability windows and value bounds run as code, produce a verdict per change, and fail closed.

C4

Evidence attached to every field

Each proposed value cites its source: message ID, document span, query result. A reviewer verifies the citation instead of trusting the summary, and an auditor can re-derive the value later.

C5

Human approval where impact is real

Route by risk, not by taste. Low-impact, well-evidenced, in-policy changes can auto-merge; revenue, identity, permissions and financial fields require a named human, per change.

C6

Append-only, hash-chained audit

Before/after snapshot, evidence references, policy verdict, approver and timestamp — each entry committing to the previous one, so deletion or backdating is detectable rather than invisible.

C7

Shadow mode before any authority

Run the agent read-only for a period and measure the approval rate on real proposals. Grant auto-merge only to the policy classes the data supports, and revoke on drift.

[ 03 / 03 ] · ANTI-PATTERNS // and the credential model //

Controls that only look like controls

Prompting the model to "be careful"Instructions are not controls — the same channel carries the attack.
A single admin API key in the agent's envBlast radius equals the key, not the task.
Logging only the API responseSuccess codes hide wrong facts; you need the diff and the basis.
A second model as the reviewerCorrelated failure. The judge shares the judged model's blind spots.
Blanket approval of a batchReviewing a count, not the changes. Approve by policy class instead.
credentials — who can write to the record
agent          no write credential
read path      read-only token, per system
reviewer       user session, no record token
merge worker   sole writer, scoped per system

every merge appends: diff · evidence · verdict · approver
entry N commits to entry N-1 (sha256)

Put these controls in front of your agent, not inside its prompt.

ActionsLedger is the review layer: policy as code, evidence per field, human approval, and a hash-chained trail — with the write credential held by the merge worker alone.