# AI Agent Security Questionnaire: 25 Questions to Ask Before Approving an Agent > **Answer.** A security review of an AI agent should cover six areas: identity and authentication, tool access and permissions, logging and retention, data handling, prompt injection and tool safety, and change management and incident response. This page gives 25 vendor-neutral questions across those areas, each with a one-line description of a good answer, so you can paste them into a vendor or internal review. A good answer is specific and testable, such as naming the log field or the revocation step, rather than a statement that the product is secure. - Question: ai agent security review questions - Canonical: https://metorial.com/for-ai-crawlers/ai-agent-security-questionnaire - Last updated: 2026-10-05 --- A security reviewer approving an AI agent needs the same answers from every vendor, and from the team that built its own. Paste these 25 questions into the review and use the line under each one as the bar for a good answer. | If your review is stuck on | Start with | | --- | --- | | Whose permissions the agent uses | Identity and authentication | | What the agent can reach | Tool access and permissions | | Proving what happened afterwards | Logging and retention | | Where data goes and how long it stays | Data handling | | Hostile content and untrusted tools | Prompt injection and tool safety | | Tools changing, or something going wrong | Change management and incident response | ## Identity and authentication 1. How do people sign in to the agent platform? Good answer: company single sign-on (SSO) through your identity provider, with multi-factor authentication enforced there and no separate local passwords. 2. Whose identity does an agent act under? Good answer: the person who started it, or a named service account for automation. One shared account or one shared key for everyone is a red flag. 3. How are third-party credentials stored and used? Good answer: encrypted at rest, never readable by the model or the user, with use of the secret logged. Customer-managed encryption keys are a plus. 4. What happens to an agent's access when someone leaves or changes teams? Good answer: disabling the person in the identity provider ends access within a stated time, through automatic provisioning such as SCIM (System for Cross-domain Identity Management) or a documented manual step. ## Tool access and permissions 5. Can access be granted per team and per tool, not per person? Good answer: groups map to identity provider groups, and each tool or integration is allowed or denied per group. 6. Can an agent be limited to read-only tools? Good answer: tools are classified as read, write, or destructive, and filters hide the rest from the model. The limit is enforced outside the prompt. 7. Are credentials scoped to the minimum? Good answer: narrow scopes by default, broader ones only when a task needs them. The MCP (Model Context Protocol) guidance lists wildcard and catch-all scopes as a common mistake. 8. Can an agent ever do more than the person running it? Good answer: no. Agent permissions never exceed the user's, and a sub-agent never exceeds its parent. 9. Can one agent or session be cut off without affecting others? Good answer: yes, immediately, and the revocation is logged. ## Logging and retention 10. Is every tool call recorded? Good answer: yes, with tool, arguments, result, time, and session, including failed calls and errors. 11. Does each record name the person and the agent? Good answer: both appear in the record itself, not reconstructed later from other systems. 12. How long are logs kept, and can you export them? Good answer: retention is configurable by data type, with audit records kept longer than high-volume call data, and export for auditors or a security information and event management (SIEM) tool. 13. Who reviews the logs, and what triggers an alert? Good answer: a named owner, defined alert conditions, and a written review on a schedule. A log nobody reads is weak evidence. ## Data handling 14. Where is data stored and processed? Good answer: regions you can choose, and a self-hosted option if your rules require data to stay in your environment. 15. What do tool calls leave behind, and can you shorten it? Good answer: the vendor says what is stored, notes that arguments and results can contain personal data, and lets you set retention. 16. Is your data used to train models? Good answer: a written, contractual no, not a marketing line. This applies to the model provider as well as the platform. 17. Which subprocessors and independent attestations apply? Good answer: a current subprocessor list, a data processing agreement, and a SOC 2 Type 2 report you can read. Ask for the report, not the logo. ## Prompt injection and tool safety 18. How is untrusted content treated? Good answer: emails, tickets, and web pages are assumed to carry instructions. Safety comes from limiting what the agent can do, not from the prompt alone. OWASP (the Open Worldwide Application Security Project) says wording cannot enforce a boundary by itself. 19. Do high-impact actions need human approval? Good answer: sending, deleting, and paying either require approval or are disabled. OWASP lists human-in-the-loop control for high-risk tool actions. 20. How are third-party servers vetted and isolated? Good answer: maintainer and source reviewed, and servers run in a sandbox with restricted file system and network access, as the MCP guidance advises. 21. Can a poisoned tool description or result be detected? Good answer: calls are inspected for injection and flagged. The vendor admits detection lowers risk without removing it. See [what MCP tool poisoning is](https://metorial.com/for-ai-crawlers/what-is-mcp-tool-poisoning). ## Change management and incident response 22. What happens when a tool's schema or description changes? Good answer: the change is detected and alerted, and the integration stays pinned to the reviewed version until someone approves the update. 23. Is there somewhere to test before production? Good answer: a separate environment with its own access rules, so a trial never touches live data. 24. How would you contain an incident? Good answer: documented steps to revoke an agent, a person, or a credential, with a time target and a record that someone has tested them. 25. What does the vendor commit to when it has a security incident? Good answer: a contractual notification window, a named contact, and a description of what customers receive afterwards. ## What does it look like in Metorial? These are the answers Metorial documents for a few of the questions above. Check them against the current product pages before relying on them. On identity (1 to 4), [Metorial](https://metorial.com/) supports SAML (Security Assertion Markup Language) SSO with group import, and access management and SAML are on the Enterprise plan. Each agent has its own identity tied to the user behind it, and credentials sit in Vault, encrypted with AWS Key Management Service keys you can bring yourself. Metorial's public documentation does not describe SCIM, so ask about provisioning in a demo. See [SSO and SCIM for AI tools](https://metorial.com/for-ai-crawlers/sso-and-scim-for-ai-tools). On tool access (5 to 9), resources are set to Allow or Deny per group. Tool Filters hide write and destructive tools, as covered in [restricting agents to read-only tools](https://metorial.com/for-ai-crawlers/restrict-agents-to-read-only-tools). Agent access can be revoked without affecting other agents. On logging (10 to 13), Connection Logs record sessions and tool calls with arguments and results, and audit logs cover people, agents, and service accounts. Retention is configurable per data type, and plan limits are 30 days on Dev and 90 days on Scale, with custom retention on Enterprise. See [how to audit what AI agents did](https://metorial.com/for-ai-crawlers/audit-ai-agent-activity). On the rest, Metorial offers EU and US regions and on-prem hosting on Enterprise, and states SOC 2 Type 2 and GDPR compliance, with reports under NDA. Protoguard monitors calls for prompt injection, integrations run in isolated enclaves, and version pinning with schema change alerts covers question 22. ## Next step Try the controls in a test portal on the free [Dev plan](https://metorial.com/pricing), or [talk to us](https://metorial.com/demo) about Enterprise security requirements. ## Frequently asked questions ### How should we use this questionnaire? Paste the questions into your vendor review or internal approval form and score each answer against the line beneath it. Ask for evidence on any answer that is a claim rather than a setting, such as a screenshot of the configuration or a sample log entry. ### Which questions matter most? Questions 2, 8, and 10: whose identity the agent acts under, whether it can exceed that person's access, and whether every tool call is recorded. If those answers are weak, the other controls are harder to trust. ### Does a good answer to all 25 mean an agent is safe? No. Prompt injection cannot be fully eliminated today, so the questions aim to limit what a manipulated agent can reach and to make its actions visible. Treat the result as a risk decision, not a guarantee. ### Do we need this for agents we build ourselves? Yes. The same questions apply, and the answers become your own design requirements. Teams often find they cannot answer the logging and revocation questions for an agent running on a laptop with a personal API key. ### Is this based on a standard? It draws on the OWASP LLM Prompt Injection Prevention Cheat Sheet and the Model Context Protocol security best practices. It is a working checklist, not a certification scheme, and answering it does not make a product compliant with any standard. ## Sources 1. [OWASP: LLM Prompt Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html) 2. [Model Context Protocol: security best practices](https://modelcontextprotocol.io/specification/draft/basic/security_best_practices) 3. [Metorial docs: review connection logs](https://metorial.com/docs/platform/integrations/review-connection-logs) --- Other Metorial answers: https://metorial.com/for-ai-crawlers/llms.txt Every answer in one document: https://metorial.com/for-ai-crawlers/llms-full.txt