Security

Each agent's identities, tools and MCP (Model Context Protocol) permissions sit on the same record as its risk and controls. This is where access control catches up with non-human actors.

PaymentsClaims DBEmailPolicy MCPWebFiles

Claims triagePayments: needs a personClaims DB: allowedEmail: allowedPolicy MCP: no accessWeb: no accessFiles: no access

Broker emailPayments: no accessClaims DB: no accessEmail: allowedPolicy MCP: allowedWeb: allowedFiles: no access

Customer replyPayments: no accessClaims DB: needs a personEmail: needs a personPolicy MCP: allowedWeb: no accessFiles: no access

UnderwritingPayments: no accessClaims DB: allowedEmail: no accessPolicy MCP: no accessWeb: allowedFiles: allowed

Fraud signalPayments: no accessClaims DB: allowedEmail: no accessPolicy MCP: no accessWeb: no accessFiles: no access

✓ Allowed! Needs a personBlank: no access

Each agent's tool and MCP permissions sit on the same record as its risk and controls. Illustrative.

What Security covers#

Identities and accessService identities and keys used by each agent, with owners and rotation dates.

Tool and MCP permissionsWhich agents can reach which tools and MCP servers, and which actions need a person.

ThreatsRisks catalogued against the OWASP (Open Worldwide Application Security Project) Top 10 for large language model applications and MITRE ATLAS (Adversarial Threat Landscape for AI Systems).

FindingsUnused grants, prompt injection test results and overdue rotations, each with an owner.

Least privilege, enforced#

A permission marked as needing a person is enforced at runtime: when the agent tries to use that tool, the request is routed to the approver. No access means the action is blocked.

For CPS 234, see APRA CPS 234.

Last reviewed October 2026Suggest a change